MEDIUM
libtool: libltdl may load and execute code from a library in the current directory
Published Nov 27, 2009
6.9
MEDIUMCVSS 2.0
EPSS 0.39%
Description
ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.
Affected products
No data.
OR
- 1.5
- 1.5.2
- 1.5.4
- 1.5.6
- 1.5.8
- 1.5.10
- 1.5.12
- 1.5.14
- 1.5.16
- 1.5.18
- 1.5.20
- 1.5.22
- 1.5.24
- 1.5.26
- 2.2.6a
No data.
Red Hat Enterprise Linux 3
gcc-0:3.2.3-60
Fixed · RHSA-2010:0039
Red Hat Enterprise Linux 3
libtool-0:1.4.3-7
Fixed · RHSA-2009:1646
Red Hat Enterprise Linux 4
gcc-0:3.4.6-11.el4_8.1
Fixed · RHSA-2010:0039
Red Hat Enterprise Linux 4
gcc4-0:4.1.2-44.EL4_8.1
Fixed · RHSA-2010:0039
Red Hat Enterprise Linux 4
libtool-0:1.5.6-5.el4_8
Fixed · RHSA-2009:1646
Red Hat Enterprise Linux 5
gcc-0:4.1.2-46.el5_4.2
Fixed · RHSA-2010:0039
Red Hat Enterprise Linux 5
libtool-0:1.5.22-7.el5_4
Fixed · RHSA-2009:1646
Red Hat Enterprise Linux 4
guile
Not affected
Red Hat Enterprise Linux 5
gcc44
Will not fix
Red Hat Enterprise Linux 5
guile
Will not fix
Red Hat Enterprise Linux 6
guile
Will not fix
Red Hat Enterprise Linux 6
libtool
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 3 | gcc-0:3.2.3-60 | Fixed | RHSA-2010:0039 |
| Red Hat Enterprise Linux 3 | libtool-0:1.4.3-7 | Fixed | RHSA-2009:1646 |
| Red Hat Enterprise Linux 4 | gcc-0:3.4.6-11.el4_8.1 | Fixed | RHSA-2010:0039 |
| Red Hat Enterprise Linux 4 | gcc4-0:4.1.2-44.EL4_8.1 | Fixed | RHSA-2010:0039 |
| Red Hat Enterprise Linux 4 | libtool-0:1.5.6-5.el4_8 | Fixed | RHSA-2009:1646 |
| Red Hat Enterprise Linux 5 | gcc-0:4.1.2-46.el5_4.2 | Fixed | RHSA-2010:0039 |
| Red Hat Enterprise Linux 5 | libtool-0:1.5.22-7.el5_4 | Fixed | RHSA-2009:1646 |
| Red Hat Enterprise Linux 4 | guile | Not affected | n/a |
| Red Hat Enterprise Linux 5 | gcc44 | Will not fix | n/a |
| Red Hat Enterprise Linux 5 | guile | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | guile | Will not fix | n/a |
| Red Hat Enterprise Linux 6 | libtool | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (0)
No CWE recorded.
References (41)
- ftp://ftp.gnu.org/gnu/libtool/libtool-2.2.6a-2.2.6b.diff.gz x_refsource_CONFIRMPatch
- http://git.savannah.gnu.org/cgit/libtool.git/commit/?h=branch-1-5&id=29b48580df75f0c5baa2962548a4c101ec7ed7ec x_refsource_CONFIRMPatch
- http://hamlib.svn.sourceforge.net/viewvc/hamlib/trunk/libltdl/Makefile.am?revision=2841&view=markup x_refsource_CONFIRM
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 x_refsource_CONFIRM
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035133.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035168.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054656.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054915.html vendor-advisoryx_refsource_FEDORA
- http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054921.html vendor-advisoryx_refsource_FEDORA
- http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html mailing-listx_refsource_MLISTPatch
- http://lists.gnu.org/archive/html/libtool/2009-11/msg00065.html mailing-listx_refsource_MLISTPatch
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html vendor-advisoryx_refsource_SUSE
- http://secunia.com/advisories/37414 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/37489 third-party-advisoryx_refsource_SECUNIAVendor Advisory
- http://secunia.com/advisories/37997 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/38190 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/38577 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/38617 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/38696 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/38915 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/39299 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/39347 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/43617 third-party-advisoryx_refsource_SECUNIA
- http://secunia.com/advisories/55721 third-party-advisoryx_refsource_SECUNIA
- http://security.gentoo.org/glsa/glsa-201311-10.xml vendor-advisoryx_refsource_GENTOO
- http://support.avaya.com/css/P8/documents/100074869 x_refsource_CONFIRM
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:307 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:035 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:091 vendor-advisoryx_refsource_MANDRIVA
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:105 vendor-advisoryx_refsource_MANDRIVA
- http://www.redhat.com/support/errata/RHSA-2010-0039.html vendor-advisoryx_refsource_REDHAT
- http://www.securityfocus.com/bid/37128 vdb-entryx_refsource_BIDPatch
- http://www.vupen.com/english/advisories/2011/0574 vdb-entryx_refsource_VUPEN
- https://access.redhat.com/security/cve/CVE-2009-3736 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=537941 x_refsource_CONFIRMPatchIssue Tracking
- https://nvd.nist.gov/vuln/detail/CVE-2009-3736
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11687 vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6951 vdb-entrysignaturex_refsource_OVAL
- https://rhn.redhat.com/errata/RHSA-2010-0095.html vendor-advisoryx_refsource_REDHAT
- https://www.cve.org/CVERecord?id=CVE-2009-3736
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01512.html vendor-advisoryx_refsource_FEDORA
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner certcc
Published Nov 27, 2009
Updated Aug 7, 2024
Reserved Oct 22, 2009
Link CVE-2009-3736
CISA Vulnrichment
Updated n/a