Vulnerability CVE-2011-1658 - CERT Civis.Net

Vulnerability Name:

CVE-2011-1658 (CCN-66820)

Assigned:

2011-01-12

Published:

2011-01-12

Updated:

2018-10-09

Summary:

ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2) setgid program with this RPATH value, and then executing the program with a crafted value for the LD_PRELOAD environment variable, a different vulnerability than CVE-2010-3847 and CVE-2011-0536.
Note: it is not expected that any standard operating-system distribution would ship an applicable setuid or setgid program.

CVSS v3 Severity:

5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

3.7 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P)
2.7 Low (Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.2 Medium (REDHAT CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C)
4.6 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): High Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2011-1658

Source: CCN
Type: RHSA-2011-0412
Important: glibc security update

Source: CCN
Type: RHSA-2011-0413
Important: glibc security update

Source: CCN
Type: SA46397
VMware ESX / ESXi Server Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
46397

Source: MISC
Type: Patch
http://sourceware.org/bugzilla/show_bug.cgi?id=12393

Source: CCN
Type: GNU C Library Web page
GNC C Library - GNU Project - Free Software Foundation (FSF)

Source: BUGTRAQ
Type: UNKNOWN
20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

Source: CCN
Type: BID-64469
GNU glibc Dynamic Linker '$ORIGIN' Local Privilege Escalation Vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2011-0012.html

Source: CCN
Type: Red Hat Bugzilla Bug 667974
(CVE-2011-0536) CVE-2011-0536 glibc: CVE-2010-3847 fix causes linker to search CWD when running privileged program with $ORIGIN in R*PATH

Source: MISC
Type: Patch
https://bugzilla.redhat.com/show_bug.cgi?id=667974

Source: XF
Type: UNKNOWN
gnuclibrary-ldso-priv-esc(66820)

Source: XF
Type: UNKNOWN
gnuclibrary-ldso-priv-esc(66820)

Vulnerable Configuration:

Configuration 1:

cpe:/a:gnu:glibc:1.00:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.01:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.02:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.03:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.04:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.05:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.06:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.07:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.08:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.09:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.09.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.9:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.6.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.7:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.8:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.9:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.0:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:*:*:*:*:*:*:*:* (Version <= 2.13)

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

Configuration RedHat 4:

cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

Configuration RedHat 5:

cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

Configuration RedHat 6:

cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

Configuration RedHat 7:

cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

Configuration CCN 1:

cpe:/a:gnu:glibc:2.2.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.9:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.2.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.7:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.4:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.6:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.6.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.8:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.9:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.3.5:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.10.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.09:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.08:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.07:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.06:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.05:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.04:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.03:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.02:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.01:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.00:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.0:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:1.09.1:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.3:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.11.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.12.2:*:*:*:*:*:*:*

OR cpe:/a:gnu:glibc:2.13:*:*:*:*:*:*:*

AND

cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_eus:5.6.z::server:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux_long_life:5.6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:23373	P	ELSA-2011:0413: glibc security update (Important)	2014-07-21
oval:org.mitre.oval:def:15237	P	USN-1396-1 -- GNU C Library vulnerabilities	2014-06-30
oval:org.mitre.oval:def:23052	P	ELSA-2011:0412: glibc security update (Important)	2014-05-26
oval:org.mitre.oval:def:21331	P	RHSA-2011:0413: glibc security update (Important)	2014-02-24
oval:org.mitre.oval:def:21873	P	RHSA-2011:0412: glibc security update (Important)	2014-02-24
oval:org.mitre.oval:def:20514	V	VMware ESX third party updates for Service Console packages glibc and dhcp	2014-01-20
oval:org.mitre.oval:def:20402	V	VMware ESX third party updates for Service Console packages glibc and dhcp	2014-01-20
oval:com.redhat.rhsa:def:20110412	P	RHSA-2011:0412: glibc security update (Important)	2011-04-04
oval:com.redhat.rhsa:def:20110413	P	RHSA-2011:0413: glibc security update (Important)	2011-04-04