apache: privilege escalation [LWN.net]

Package(s):

apache

CVE #(s):

CVE-2012-0883

Created:

June 25, 2012

Updated:

February 12, 2013

Description:

From the CVE entry:

envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl.

Alerts:

Gentoo	201206-25	2012-06-24
Mandriva	MDVSA-2012:154	2012-09-28
Mandriva	MDVSA-2012:154-1	2012-10-01
Mageia	MGASA-2012-0280	2012-10-06
openSUSE	openSUSE-SU-2013:0243-1	2013-02-05
openSUSE	openSUSE-SU-2013:0248-1	2013-02-05
Fedora	FEDORA-2013-1661	2013-02-12

(Log in to post comments)

apache: privilege escalation

Posted Jun 28, 2012 9:49 UTC (Thu) by rwmj (subscriber, #5474) [Link]

Why should empty elements of paths mean "use random stuff from the current directory"? It means when you write:

export LD_LIBRARY_PATH=/somedir:$LD_LIBRARY_PATH

that you've accidentally introduced a security bug.

I emailed Ulrich Drepper about the security-hostile behaviour of LD_LIBRARY_PATH back in 2000. He rejected the change then. I'm not happy to see that it's still causing security holes 12 years later.

apache: privilege escalation

Posted Jun 28, 2012 11:40 UTC (Thu) by nix (subscriber, #2304) [Link]

Agreed. It *is* the standard behaviour of PATH-searching programs to consider an empty element to mean '.', but nobody seems to expect it: I've encountered empty elements half a dozen times now, and in each case the person who introduced it did so accidentally, thought an empty element would be skipped, and didn't realise the consequences.

Perhaps some (really crappy) code out there is depending on this behaviour. Let it break, I say. (Oddly Uli was happy to say 'let it break' about much more significant bodies of code at times.)