The (1) banshee-1 and (2) muinshee scripts in Banshee 1.8.0 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory. NOTE: Banshee might also be affected using GST_PLUGIN_PATH.

The remote host is affected by the vulnerability described in GLSA-201402-05 (Banshee: Arbitrary code execution)

    Banshee places a zero-length directory name in PATH, which allows       libraries to be loaded from the working directory.
  Impact :

    A local attacker could put specially crafted library into working       directory of Banshee, possibly resulting in execution of arbitrary code       with the privileges of the process, or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

A vulnerability has been found and corrected in banshee :

The (1) banshee-1 and (2) muinshee scripts in Banshee 1.8.0 and earlier place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory (CVE-2010-3998).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

The updated packages have been patched to correct this issue.

- Mon Oct 25 2010 Nathaniel McCallum <nathaniel at     natemccallum.com> - 1.8.0-10

    - Add a patch to fix CVE-2010-3998

    - Tue Oct 19 2010 Dan Horak <dan[at]danny.cz> - 1.8.0-9

    - Update the Requires to match BR on s390(x)

    - Tue Oct 19 2010 Nathaniel McCallum <nathaniel at       natemccallum.com> - 1.8.0-8

    - Added gnome-doc-utils BR

    - Mon Oct 18 2010 Dan Horak <dan[at]danny.cz> - 1.8.0-7

    - Fix BRs and configure options on s390(x)

    - Be verbose during build

    - Mon Oct 11 2010 Nathaniel McCallum <nathaniel at       natemccallum.com> - 1.8.0-6

    - Fix download URL

    - Fri Oct 8 2010 Nathaniel McCallum <nathaniel at       natemccallum.com> - 1.8.0-5

    - Add upstream patch to fix sync screen

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Oct 25 2010 Christian Krause <chkr at     fedoraproject.org> - 1.6.1-4

    - Add a patch to fix CVE-2010-3998

    - Sat Jun 26 2010 Christian Krause <chkr at       fedoraproject.org> - 1.6.1-3

    - Fix status icon transparency (BZ 533308)

    - Thu Jun 17 2010 Christian Krause <chkr at       fedoraproject.org> - 1.6.1-2

    - avoid 'DllNotFoundException: libbnpx11' when switching       to fullscreen mode

  - Tue May 18 2010 Christian Krause <chkr at     fedoraproject.org> - 1.6.1-1

    - Update to 1.6.1 release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Oct 25 2010 Christian Krause <chkr at     fedoraproject.org> - 1.6.1-4

    - Add a patch to fix CVE-2010-3998

    - Sat Jun 26 2010 Christian Krause <chkr at       fedoraproject.org> - 1.6.1-3

    - Fix status icon transparency (BZ 533308)

    - Thu Jun 17 2010 Christian Krause <chkr at       fedoraproject.org> - 1.6.1-2

    - avoid 'DllNotFoundException: libbnpx11' when switching       to fullscreen mode

  - Tue May 18 2010 Christian Krause <chkr at     fedoraproject.org> - 1.6.1-1

    - Update to 1.6.1 release

    - Thu Apr 8 2010 Christian Krause <chkr at       fedoraproject.org> - 1.6.0-1

    - Update to 1.6.0 release

    - Remove upstreamed patch (support for older mono       versions)

    - Sun Feb 28 2010 Christian Krause <chkr at       fedoraproject.org> - 1.5.5-1

    - Update to 1.5.5 release

    - Add patch to support older mono versions

    - Remove upstreamed patch (Spanish translation update)

    - Wed Feb 3 2010 Christian Krause <chkr at       fedoraproject.org> - 1.5.3-1

    - Update to final 1.5.3 release

    - Remove upstreamed patch (last.fm integration)

    - Update Spanish translation

    - Wed Dec 16 2009 Christian Krause <chkr at       fedoraproject.org> - 1.5.3-0.1.20091216git

    - Update to latest snapshot to pick up DeviceKit-disks       integration to fix iPod support (BZ 495240)

  - Add a minor patch to fix the last.fm integration

    - Tue Nov 24 2009 Christian Krause <chkr at       fedoraproject.org> - 1.5.2-1

    - Update to final 1.5.2 release

    - Wed Nov 18 2009 Christian Krause <chkr at       fedoraproject.org> - 1.5.2-0.1.20091118git

    - Update to latest snapshot

    - Remove all *.la and *.a files during %install

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
72361	GLSA-201402-05 : Banshee: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
52060	Mandriva Linux Security Advisory : banshee (MDVSA-2011:034)	Nessus	Mandriva Local Security Checks	medium
50566	Fedora 14 : banshee-1.8.0-10.fc14 (2010-17021)	Nessus	Fedora Local Security Checks	medium
50565	Fedora 13 : banshee-1.6.1-4.fc13 (2010-16916)	Nessus	Fedora Local Security Checks	medium
50564	Fedora 12 : banshee-1.6.1-4.fc12 (2010-16907)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-3998

high

Tenable Plugins

medium

medium

medium

medium

medium