1. CVE-Search
  2. CVE-2008-2366
ID CVE-2008-2366
Summary Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in the RPATH library path.
References
Vulnerable Configurations
  • cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:3.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
    cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:openoffice:openoffice:1.1:*:*:*:*:*:*:*
    cpe:2.3:a:openoffice:openoffice:1.1:*:*:*:*:*:*:*
CVSS
Base: 4.4 (as of 29-09-2017 - 01:31)
Impact:
Exploitability:
CWE CWE-16
CAPEC
Access
VectorComplexityAuthentication
LOCAL MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:M/Au:N/C:P/I:P/A:P
oval via4
accepted 2013-04-29T04:13:31.500-04:00
class vulnerability
contributors
  • name Aharon Chernin
    organization SCAP.com, LLC
  • name Dragos Prisaca
    organization G2, Inc.
definition_extensions
  • comment The operating system installed on the system is Red Hat Enterprise Linux 3
    oval oval:org.mitre.oval:def:11782
  • comment CentOS Linux 3.x
    oval oval:org.mitre.oval:def:16651
  • comment The operating system installed on the system is Red Hat Enterprise Linux 4
    oval oval:org.mitre.oval:def:11831
  • comment CentOS Linux 4.x
    oval oval:org.mitre.oval:def:16636
  • comment Oracle Linux 4.x
    oval oval:org.mitre.oval:def:15990
description Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in the RPATH library path.
family unix
id oval:org.mitre.oval:def:11361
status accepted
submitted 2010-07-09T03:56:16-04:00
title Untrusted search path vulnerability in a certain Red Hat build script for OpenOffice.org (OOo) 1.1.x on Red Hat Enterprise Linux (RHEL) 3 and 4 allows local users to gain privileges via a malicious library in the current working directory, related to incorrect quoting of the ORIGIN symbol for use in the RPATH library path.
version 30
redhat via4
advisories
bugzilla
id 450532
title CVE-2008-2366 openoffice.org: insecure relative RPATH in OOo 1.1.x packages
oval
OR
  • comment Red Hat Enterprise Linux must be installed
    oval oval:com.redhat.rhba:tst:20070304026
  • AND
    • comment Red Hat Enterprise Linux 4 is installed
      oval oval:com.redhat.rhba:tst:20070304025
    • OR
      • AND
        • comment openoffice.org is earlier than 0:1.1.5-10.6.0.5.EL4
          oval oval:com.redhat.rhsa:tst:20080538001
        • comment openoffice.org is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060573002
      • AND
        • comment openoffice.org-i18n is earlier than 0:1.1.5-10.6.0.5.EL4
          oval oval:com.redhat.rhsa:tst:20080538003
        • comment openoffice.org-i18n is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060573004
      • AND
        • comment openoffice.org-kde is earlier than 0:1.1.5-10.6.0.5.EL4
          oval oval:com.redhat.rhsa:tst:20080538005
        • comment openoffice.org-kde is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060573006
      • AND
        • comment openoffice.org-libs is earlier than 0:1.1.5-10.6.0.5.EL4
          oval oval:com.redhat.rhsa:tst:20080538007
        • comment openoffice.org-libs is signed with Red Hat master key
          oval oval:com.redhat.rhsa:tst:20060573008
rhsa
id RHSA-2008:0538
released 2008-06-13
severity Important
title RHSA-2008:0538: openoffice.org security update (Important)
rpms
  • openoffice.org-0:1.1.2-42.2.0.EL3
  • openoffice.org-0:1.1.5-10.6.0.5.EL4
  • openoffice.org-debuginfo-0:1.1.2-42.2.0.EL3
  • openoffice.org-debuginfo-0:1.1.5-10.6.0.5.EL4
  • openoffice.org-i18n-0:1.1.2-42.2.0.EL3
  • openoffice.org-i18n-0:1.1.5-10.6.0.5.EL4
  • openoffice.org-kde-0:1.1.5-10.6.0.5.EL4
  • openoffice.org-libs-0:1.1.2-42.2.0.EL3
  • openoffice.org-libs-0:1.1.5-10.6.0.5.EL4
refmap via4
bid 29695
confirm https://bugzilla.redhat.com/show_bug.cgi?id=450532
sectrack 1020278
secunia 30633
xf redhat-ooo-buildscript-code-execution(43322)
Last major update 29-09-2017 - 01:31
Published 16-06-2008 - 18:41
Last modified 29-09-2017 - 01:31
Back to Top