oss-security - Re: CVE-2009-0876 (VirtualBox) references

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 17 Mar 2009 15:51:09 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2009-0876 (VirtualBox) references

On Tue, 17 Mar 2009, Nico Golde wrote:

> Any reason the CVE description says "Unspecified
> vulnerability...via unknown vectors"?

This was based on the original Sun alert.  I cleaned up the description
yesterday, and the CVE web site was updated today.

> Looking at the Gentoo bug report[0] it seems obvious to me
> that this is caused by insecurely loading shared libraries
> so you can inject your own shared lib code.
>
> [0] https://bugs.gentoo.org/show_bug.cgi?id=260331#c0

It wasn't particularly obvious to me.  I may be getting hung up on the use
of hardlinks.

Is the problem that the executable includes a "." in its library path
(presumably DT_RPATH), and that path isn't cleansed until later during
program execution?  If it's just that, then the use of a hardlink doesn't
seem to be essential - the attacker could run the program from their own
directory.  Or, is it that the executable eventually removes "." from its
path, but not before some libraries have already been loaded?

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.