McAfee VirusScan DT_RPATH code execution
| mcafee-dtrpath-code-execution (30898) |  High Risk |
Description:
McAfee VirusScan for Linux could allow a local attacker to execute arbitrary code on the system caused by a vulnerability in the DT_RPATH variable. A local attacker could install malicious ELF DSO libraries into the current working directory using the DT_RPATH variable and execute arbitrary code on the system with the privileges of the application.
Platforms Affected:
- Gentoo, Linux
- McAfee, VirusScan 4.5.10e Linux
Remedy:
Apply the appropriate patch for your system. See References.
Consequences:
Gain Privileges
References:
- McAfee Web site, McAfee - Antivirus Software and Intrusion Prevention Software at http://www.mcafee.com.
- BID-21592: McAfee VirusScan For Linux Insecure DT_RPATH Remote Code Execution Vulnerability
- CVE-2006-6474: Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
- GLSA-200612-15: McAfee VirusScan: Insecure DT_RPATH
- SA23278: McAfee VirusScan Command Line Scanner Insecure DT_RPATH
- SA23429: Gentoo vlnx Insecure DT_RPATH Vulnerability
- SECTRACK ID: 1017385: McAfee VirusScan for Linux Lets Local Users Gain Elevated Privileges
- VUPEN/ADV-2006-5023: McAfee VirusScan for Linux DT_RPATH Variable Handling Code Execution Vulnerability
Reported:
Dec 15, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net