McAfee VirusScan DT_RPATH code execution
| mcafee-dtrpath-code-execution (30898) |  High Risk |
Description:
McAfee VirusScan for Linux could allow a local attacker to execute arbitrary code on the system caused by a vulnerability in the DT_RPATH variable. A local attacker could install malicious ELF DSO libraries into the current working directory using the DT_RPATH variable and execute arbitrary code on the system with the privileges of the application.
*CVSS:
| Base Score: | 4.9 |
| Access Vector: | Local |
| Access Complexity: | Low |
| Authentication: | Not Required |
| Confidentiality Impact: | Partial |
| Integrity Impact: | Partial |
| Availability Impact: | Partial |
| Temporal Score: | 4 |
| Exploitability: | Unproven |
| Remediation Level: | Unavailable |
| Report Confidence: | Uncorroborated |
Consequences:
Gain Privileges
Remedy:
Apply the appropriate patch for your system. See References.
References:
- McAfee Web site: McAfee - Antivirus Software and Intrusion Prevention Software.
- BID-21592: McAfee VirusScan For Linux Insecure DT_RPATH Remote Code Execution Vulnerability
- CVE-2006-6474: Untrusted search path vulnerability in McAfee VirusScan for Linux 4510e and earlier includes the current working directory in the DT_RPATH environment variable, which allows local users to load arbitrary ELF DSO libraries and execute arbitrary code by installing malicious libraries in that directory.
- GLSA-200612-15: McAfee VirusScan: Insecure DT_RPATH
- SA23278: McAfee VirusScan Command Line Scanner Insecure DT_RPATH
- SA23429: Gentoo vlnx Insecure DT_RPATH Vulnerability
- SECTRACK ID: 1017385: McAfee VirusScan for Linux Lets Local Users Gain Elevated Privileges
- VUPEN/ADV-2006-5023: McAfee VirusScan for Linux DT_RPATH Variable Handling Code Execution Vulnerability
Platforms Affected:
- Gentoo Linux
- McAfee VirusScan 4.5.10e Linux
Reported:
Dec 15, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.