Aladdin Ghostscript Arbitrary Shared Library Usage Vulnerability
BID:1991
Info
Aladdin Ghostscript Arbitrary Shared Library Usage Vulnerability
| Bugtraq ID: | 1991 |
| Class: | Design Error |
| CVE: |
CVE-2000-1163 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 22 2000 12:00AM |
| Updated: | Jul 06 2007 05:07PM |
| Credit: | Several Linux vendors have released advisories which address this vulnerability, including Caldera, Debian, Mandrake and Red Hat. |
| Vulnerable: |
Aladdin Enterprises Ghostscript 5.50 Aladdin Enterprises Ghostscript 5.10.15 Aladdin Enterprises Ghostscript 5.10.10 Aladdin Enterprises Ghostscript 5.10 cl Aladdin Enterprises Ghostscript 4.3 |
| Not Vulnerable: |
Aladdin Enterprises Ghostscript 5.50.8 Aladdin Enterprises Ghostscript 5.10.16 Aladdin Enterprises Ghostscript 5.10.12 cl Aladdin Enterprises Ghostscript 5.10.10 -1 Aladdin Enterprises Ghostscript 4.3.2 |
Discussion
Aladdin Ghostscript Arbitrary Shared Library Usage Vulnerability
A vulnerability occurs in certain versions of Aladdin Ghostscript, a multiplatform PostScript interpreter.
Improper use of the LD_RUN_PATH environment variable can cause the program to load shared libraries found in the current directory.
An attacker with a malicious shared library could exploit this to execute hostile code on the affected host, potentially elevating their privileges.
A vulnerability occurs in certain versions of Aladdin Ghostscript, a multiplatform PostScript interpreter.
Improper use of the LD_RUN_PATH environment variable can cause the program to load shared libraries found in the current directory.
An attacker with a malicious shared library could exploit this to execute hostile code on the affected host, potentially elevating their privileges.
Exploit / POC
Aladdin Ghostscript Arbitrary Shared Library Usage Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].
References
Aladdin Ghostscript Arbitrary Shared Library Usage Vulnerability
References:
References: