Vulnerability Name:

CVE-2012-3381 (CCN-77866)

Assigned:2012-08-16
Published:2012-08-16
Updated:2012-08-17
Summary:sfcb in sblim-sfcb places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.4 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.2 Low (Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.4 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2012-3381

Source: CCN
Type: Sourceforge: Standards Based Linux Instrumentation
httpAdapter can crash on bad content length

Source: CONFIRM
Type: UNKNOWN
http://sourceforge.net/tracker/index.php?func=detail&aid=3541554&group_id=128809&atid=712784

Source: MLIST
Type: UNKNOWN
[oss-security] 20120706 CVE Request: sblim-sfcb: insecure LD_LIBRARY_PATH usage

Source: MLIST
Type: UNKNOWN
[oss-security] 20120706 Re: CVE Request: sblim-sfcb: insecure LD_LIBRARY_PATH usage

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.novell.com/show_bug.cgi?id=770234

Source: CCN
Type: Red Hat Bugzilla Bug 838160
CVE-2012-3381 sblim-sfcb: insecure LD_LIBRARY_PATH usage

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=838160

Source: XF
Type: UNKNOWN
sblimsfcb-priv-esc(77866)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:standards_based_linux_instrumentation:sblim-sfcb:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:standards_based_linux_instrumentation:sblim-sfcb:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20123381
    V
    		CVE-2012-3381
    2022-05-20
    oval:org.opensuse.security:def:42437
    P
    		Security update for chrony (Moderate)
    2022-04-19
    oval:org.opensuse.security:def:31756
    P
    		Security update for apache2 (Important)
    2022-01-12
    oval:org.opensuse.security:def:26188
    P
    		Security update for gegl (Important)
    2021-12-28
    oval:org.opensuse.security:def:32250
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:26181
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:31714
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:32211
    P
    		Security update for transfig (Important)
    2021-10-29
    oval:org.opensuse.security:def:32210
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:26156
    P
    		Security update for open-lldp (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:32187
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-09-23
    oval:org.opensuse.security:def:26124
    P
    		Security update for openssl-1_1 (Low)
    2021-09-09
    oval:org.opensuse.security:def:32993
    P
    		Security update for libesmtp (Important)
    2021-09-02
    oval:org.opensuse.security:def:26107
    P
    		Security update for openssl-1_0_0 (Important)
    2021-08-24
    oval:org.opensuse.security:def:32162
    P
    		Security update for libcares2 (Important)
    2021-08-16
    oval:org.opensuse.security:def:32954
    P
    		Security update for libnettle (Important)
    2021-06-23
    oval:org.opensuse.security:def:32130
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:32123
    P
    		Security update for xterm (Important)
    2021-06-18
    oval:org.opensuse.security:def:42697
    P
    		sblim-sfcb-1.3.11-0.23.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36290
    P
    		sblim-sfcb-1.3.11-0.23.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32106
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-06-04
    oval:org.opensuse.security:def:26043
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:32066
    P
    		Security update for the Linux Kernel (Live Patch 38 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:32272
    P
    		Security update for python (Moderate)
    2021-03-16
    oval:org.opensuse.security:def:32274
    P
    		Security update for glib2 (Important)
    2021-03-16
    oval:org.opensuse.security:def:26209
    P
    		Security update for apache2 (Moderate)
    2021-03-12
    oval:org.opensuse.security:def:25979
    P
    		Security update for xen (Moderate)
    2020-12-18
    oval:org.opensuse.security:def:36030
    P
    		sblim-sfcb-1.3.11-0.19.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:42761
    P
    		sblim-sfcb-openssl1-1.3.11-0.28.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:36354
    P
    		sblim-sfcb-openssl1-1.3.11-0.28.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:32366
    P
    		Security update for supportutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26993
    P
    		mutt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25591
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31950
    P
    		Security update for grub2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32596
    P
    		postgresql on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31820
    P
    		Security update for augeas (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26245
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32510
    P
    		file-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33317
    P
    		sblim-sfcb-openssl1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25783
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:26533
    P
    		cups on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33214
    P
    		ntp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31768
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26416
    P
    		Security update for nginx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32316
    P
    		Security update for rsync (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31497
    P
    		Security update for python-lxml
    2020-12-01
    oval:org.opensuse.security:def:26005
    P
    		Security update for libcdio (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26635
    P
    		quagga on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25903
    P
    		Security update for util-linux (Important)
    2020-12-01
    oval:org.opensuse.security:def:26557
    P
    		gnome-screensaver on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31974
    P
    		Security update for jasper (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26258
    P
    		Security update for openconnect (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27352
    P
    		sblim-sfcb-openssl1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31582
    P
    		Security update for tar (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32430
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:27253
    P
    		openssh on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25851
    P
    		Security update for freerdp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26355
    P
    		Security update for erlang (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25580
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:31863
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32574
    P
    		libxslt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32471
    P
    		Security update for xorg-x11-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33278
    P
    		unzip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31832
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:26480
    P
    		Security update for okular (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32576
    P
    		mailman on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31757
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:26265
    P
    		Security update for guile (Low)
    2020-12-01
    oval:org.opensuse.security:def:31496
    P
    		Security update for python-imaging
    2020-12-01
    oval:org.opensuse.security:def:25921
    P
    		Recommended update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26621
    P
    		openswan on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32038
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26518
    P
    		OpenEXR on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31842
    P
    		Security update for bzip2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27317
    P
    		vte on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25915
    P
    		Security update for libosip2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26615
    P
    		mozilla-xulrunner191 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25840
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26311
    P
    		Security update for openstack-nova and openstack-neutron (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25579
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:31806
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32535
    P
    		kdebase3-runtime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32422
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27028
    P
    		sblim-sfcb on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25655
    P
    		Security update for spice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32640
    P
    		bzip2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31821
    P
    		Security update for avahi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26329
    P
    		Security update for znc (Low)
    2020-12-01
    oval:org.opensuse.security:def:32532
    P
    		java-1_4_2-ibm on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25864
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26582
    P
    		libapr-util1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33253
    P
    		sblim-sfcb on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31906
    P
    		Security update for freeradius-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26469
    P
    		Security update for phpMyAdmin (Important)
    2020-12-01
    oval:org.opensuse.security:def:31508
    P
    		Security update for python27 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26679
    P
    		cron on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25904
    P
    		Security update for gegl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26571
    P
    		kdelibs3 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25839
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26297
    P
    		Security update for libvpx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32486
    P
    		amavisd-new on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27288
    P
    		sblim-sfcb on GA media (Moderate)
    2020-12-01
    oval:com.ubuntu.precise:def:20123381000
    V
    		CVE-2012-3381 on Ubuntu 12.04 LTS (precise) - low.
    2012-08-16
    BACK
    standards_based_linux_instrumentation sblim-sfcb *
    standards_based_linux_instrumentation sblim-sfcb *