Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - valgrind: .valgrindrc loaded from untrusted locations (CVE-2008-4865)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

valgrind reads a file .valgrindrc in the current directory. Therefore local users could place such a file a world-writable directory such as /tmp and influence other users' valgrind when it's executed there.
(CVE-2008-4865)

valgrind reads a file .valgrindrc in the current directory. Therefore local users could place such a file a world-writable directory such as /tmp and influence other users' valgrind when it's executed there (CVE-2008-4865).

A vulnerability has been identified and corrected in valgrind :

Untrusted search path vulnerability in valgrind before 3.4.0 allows local users to execute arbitrary programs via a Trojan horse .valgrindrc file in the current working directory, as demonstrated using a malicious --db-command options. NOTE: the severity of this issue has been disputed, but CVE is including this issue because execution of a program from an untrusted directory is a common scenario. (CVE-2008-4865)

The updated packages have been patched to prevent this.

The remote host is affected by the vulnerability described in GLSA-200902-03 (Valgrind: Untrusted search path)

    Tavis Ormandy reported that Valgrind loads a .valgrindrc file in the     current working directory, executing commands specified there.
  Impact :

    A local attacker could prepare a specially crafted .valgrindrc file and     entice a user to run Valgrind from the directory containing that file,     resulting in the execution of arbitrary code with the privileges of the     user running Valgrind.
  Workaround :

    Do not run 'valgrind' from untrusted working directories.

ID	Name	Product	Family	Severity
198439	RHEL 4 : valgrind (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
51763	SuSE 10 Security Update : valgrind (ZYPP Patch Number 5803)	Nessus	SuSE Local Security Checks	high
40146	openSUSE Security Update : valgrind (valgrind-321)	Nessus	SuSE Local Security Checks	high
38051	Mandriva Linux Security Advisory : valgrind (MDVSA-2009:057)	Nessus	Mandriva Local Security Checks	high
35674	GLSA-200902-03 : Valgrind: Untrusted search path	Nessus	Gentoo Local Security Checks	high
34989	openSUSE 10 Security Update : valgrind (valgrind-5809)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2008-4865

high

Tenable Plugins

high

high

high

high

high

high