Gnucash: Privilege-Escalation Vulnerability

Users of gnucash please be advised of a privilege-escalation vulnerability that has been identified.
To view this vulnerability, possible remedies, and others please check out the Security Advisories at Critical Watch (http://criticalwatch.com/support/security-advisories.aspx)

MDVSA-2010:241: [MDVSA-2010:241] gnucash privilege-escalation
Problem Description:

A vulnerability was discovered and corrected in gnucash:

gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length

directory name in the LD_LIBRARY_PATH, which allows local users to

gain privileges via a Trojan horse shared library in the current

working directory (CVE-2010-3999).

The affected /usr/bin/gnc-test-env file has been removed to mitigate

the CVE-2010-3999 vulnerability as gnc-test-env is only used for

tests and while building gnucash.

Read more at http://www.criticalwatch.com

 

Advertisements