Title: Multiple Linux Vendor TCLTK Unsafe Library Searching Vulnerability
Severity: MODERATE
Description:
TCL/TK is the Tool Command Language/Toolkit originally developed by Sun Microsystems, and now maintained by public domain.
A problem in the TCL/TK packages included with some Linux distributions may lead to a local user gaining elevated privileges. The problem is in the way the TCL/TK package loads libraries.
When a program using TCL is executed on a host, or a TCL script is executed, TCL searches for dynamic libraries. Once the dynamic libraries are found, execution of the script or program begins.
The TCL implementation used on some Linux distributions begins the search with the current working directory that the script or program is being executed from. In the event that TCL is called from a world writable directory, and a file matching the name of one of the libraries exists in the current directory, that file would be loaded.
This problem could allow a malicious user to create a malicious custom library, in a world writable directory. Upon a user executing a command from the directory that uses TCL, the malicious library would be loaded, executing the code within the library with the permissions of the user. This could lead to privilege elevation, or administrative access.
Affected Products:
- Conectiva Linux 6.0.0
- Conectiva Linux 7.0.0
- HP Secure OS software for Linux 1.0.0
- MandrakeSoft Linux Mandrake 7.2.0
- MandrakeSoft Linux Mandrake 8.0.0
- MandrakeSoft Linux Mandrake 8.0.0 ppc
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Single Network Firewall 7.2.0
- RedHat Linux 7.0.0
- RedHat Linux 7.0.0 alpha
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.1.0
- RedHat Linux 7.1.0 alpha
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.1.0 ia64
- RedHat Linux 7.1.0 iseries
- RedHat Linux 7.1.0 pseries
References:
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
