Executive Summary

Informations
Name MDVSA-2010:241 First vendor Publication 2010-11-24
Vendor Mandriva Last vendor Modification 2010-11-24
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 6.9 Attack Range Local
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability was discovered and corrected in gnucash:

gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory (CVE-2010-3999).

The affected /usr/bin/gnc-test-env file has been removed to mitigate the CVE-2010-3999 vulnerability as gnc-test-env is only used for tests and while building gnucash.

Additionally for Mandriva 2010.1 gnucash-2.2.9 was not compatible with guile. This update adapts gnucash to the new API of guile.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2010:241

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 30

OpenVAS Exploits

Date Description
2010-12-02 Name : Fedora Update for gnucash FEDORA-2010-16762
File : nvt/gb_fedora_2010_16762_gnucash_fc14.nasl
2010-12-02 Name : Mandriva Update for gnucash MDVSA-2010:241 (gnucash)
File : nvt/gb_mandriva_MDVSA_2010_241.nasl
2010-11-16 Name : Fedora Update for gnucash FEDORA-2010-16605
File : nvt/gb_fedora_2010_16605_gnucash_fc13.nasl
2010-11-16 Name : Fedora Update for gnucash FEDORA-2010-16622
File : nvt/gb_fedora_2010_16622_gnucash_fc12.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
69298 GnuCash gnc-test-env LD_LIBRARY_PATH Zero-length Directory Name Path Subversi...

GnuCash contains a path subversion flaw that may allow an attacker to gain access to unauthorized privileges. The issue is triggered when the 'src/gnc-test-env' script incorrectly sets the environment variable 'LD_LIBRARY_PATH', allowing a context-dependent attacker to gain elevated privileges by tricking a user into running the script in a directory containing a malicious library.

Nessus® Vulnerability Scanner

Date Description
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-09.nasl - Type : ACT_GATHER_INFO
2010-11-28 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-241.nasl - Type : ACT_GATHER_INFO
2010-11-05 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16762.nasl - Type : ACT_GATHER_INFO
2010-11-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16605.nasl - Type : ACT_GATHER_INFO
2010-11-01 Name : The remote Fedora host is missing a security update.
File : fedora_2010-16622.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:41:55
  • Multiple Updates