[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150513172159.E7D0D6C001E@smtpvmsrv1.mitre.org>
Date: Wed, 13 May 2015 13:21:59 -0400 (EDT)
From: cve-assign@...re.org
To: mtasaka@...oraproject.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for proxychains-ng : current path as the first directory for the library search path
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> ... proxychains4,
> which firstly sets LD_PRELOAD to dlopen libproxychains4.so
> (contained in the same binary rpm) and execvp() the arbitrary
> command user has specified.
>
> Looking at the code, this program (proxychains4) sets the current
> directory as the first path to search libproxychains4.so. ref:
>
> https://github.com/rofl0r/proxychains-ng/blob/master/src/main.c#L35
Use CVE-2015-3887.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVU4eXAAoJEKllVAevmvmsiocIAKgERxYqdSjl71wTIZfXc2CH
sVBdKfbzkFVV74rNQtVkrACnhmtWoUdCmhmSAJ/ae4AgioRF4sn2RFQTDqLeEbBw
O4W0tLVFYr4mTJrqyBvF0DZDFDdi3nwmF/f35/j2FDaxvpafqLtJ7CZks0IcUEYd
ZtT/Qr/nl8OAQ296nNLILiXzrIFsHviLZq8JE3eMlzt42a12hyVb7LuYkIxq7Jmf
bq42w8e7tiJblMNHJTduXzDKCP636C9Cx7jioTs5YwMsLhc0g6P2u0NNuT/Hddle
vhCiDJ548OT1494+s3Ll0dufRTmPwgMYEKO++BJnbAtJguE7t2bEYNVDdyAsOZM=
=Ikp6
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
