The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries :

  - Berkeley DB NSS module
  - cURL / libcURL
  - GnuTLS
  - Network Security Services (NSS) Library
  - OpenLDAP
  - OpenSSL
  - OpenSSL Kerberos
  - sudo

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2010-0347 advisory.

    [2.2-35.4]
    - import Kees Cook's patch to fix accidental leakage of part of ./DB_CONFIG       (#580542, CVE-2010-0826)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that nss_db did not specify a path to the directory to be used as the database environment for the Berkeley Database library, causing it to use the current working directory as the default. This could possibly allow a local attacker to obtain sensitive information. (CVE-2010-0826)

a. Service Console update for NSS_db

   The service console package NSS_db is updated to version    nss_db-2.2-35.4.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0826 to this issue.

b. Service Console update for OpenLDAP

   The service console package OpenLDAP updated to version    2.3.43-12.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-3767 to this issue.

c. Service Console update for cURL

   The service console packages for cURL updated to version    7.15.5-9.el5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-0734 to this issue.

d. Service Console update for sudo

   The service console package sudo updated to version 1.7.2p1-7.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-1646 to this issue.

e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR

   Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2    and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8,    and NSS to version 3.12.6-1.3235.vmw and NSPR to version    4.8.4-1.3235.vmw. These four updates are bundled together due to    their mutual dependencies.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245    and CVE-2010-0433 to the issues addressed in this update.

A vulnerability has been found and corrected in nss_db :

The Free Software Foundation (FSF) Berkeley DB NSS module (aka libnss-db) 2.2.3pre1 reads the DB_CONFIG file in the current working directory, which allows local users to obtain sensitive information via a symlink attack involving a setgid or setuid application that uses this module (CVE-2010-0826).

The updated packages have been patched to correct this issue.

Stephane Chazelas reported that the nss_db module attempts to read a DB_CONFIG file in the current directory when it is used. If the contents of the file can't be parsed properly, the copy of libdb which nss_db uses will print an error message. If nss_db is invoked from a setuid process, it may then expose privileged information to the unprivileged user who started the process. This update imports Kees Cook's fix for the issue (CVE-2010-0826).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated nss_db packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The nss_db packages provide a set of C library extensions which allow Berkeley Database (Berkeley DB) databases to be used as a primary source of aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services, and shadow passwords. These databases are used instead of or in addition to the flat files used by these tools by default.

It was discovered that nss_db did not specify a path to the directory to be used as the database environment for the Berkeley Database library, causing it to use the current working directory as the default. This could possibly allow a local attacker to obtain sensitive information. (CVE-2010-0826)

Users of nss_db are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2010:0347 advisory.

    The nss_db packages provide a set of C library extensions which allow     Berkeley Database (Berkeley DB) databases to be used as a primary source of     aliases, ethers, groups, hosts, networks, protocols, users, RPCs, services,     and shadow passwords. These databases are used instead of or in addition to     the flat files used by these tools by default.

    It was discovered that nss_db did not specify a path to the directory to be     used as the database environment for the Berkeley Database library, causing     it to use the current working directory as the default. This could possibly     allow a local attacker to obtain sensitive information. (CVE-2010-0826)

    Users of nss_db are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Stephane Chazelas discovered that libnss-db did not correctly set up a database environment. A local attacker could exploit this to read the first line of arbitrary files, leading to a loss of privacy and possibly privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89742	VMware ESX Multiple Vulnerabilities (VMSA-2010-0015) (remote check)	Nessus	VMware ESX Local Security Checks	critical
68030	Oracle Linux 5 : nss_db (ELSA-2010-0347)	Nessus	Oracle Linux Local Security Checks	critical
60780	Scientific Linux Security Update : nss_db on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
49703	VMSA-2010-0015 : VMware ESX third-party updates for Service Console	Nessus	VMware ESX Local Security Checks	critical
48179	Mandriva Linux Security Advisory : nss_db (MDVSA-2010:077)	Nessus	Mandriva Local Security Checks	low
47434	Fedora 12 : nss_db-2.2-47.fc12 (2010-6361)	Nessus	Fedora Local Security Checks	low
47431	Fedora 11 : nss_db-2.2-46.fc11 (2010-6331)	Nessus	Fedora Local Security Checks	low
47423	Fedora 13 : nss_db-2.2.3-0.3.pre1.fc13 (2010-6203)	Nessus	Fedora Local Security Checks	low
46755	CentOS 5 : nss_db (CESA-2010:0347)	Nessus	CentOS Local Security Checks	low
46297	RHEL 5 : nss_db (RHSA-2010:0347)	Nessus	Red Hat Local Security Checks	critical
45398	Ubuntu 8.04 LTS / 8.10 / 9.04 / 9.10 : libnss-db vulnerability (USN-922-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2010-0826

critical

Tenable Plugins

critical

critical

low

critical

low

low

low

low

low

critical

low