The capsh program in libcap before 2.22 does not change the current working directory when the --chroot option is specified, which allows local users to bypass the chroot restrictions via unspecified vectors.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1694 advisory.

  - The capsh program in libcap before 2.22 does not change the current working directory when the --chroot     option is specified, which allows local users to bypass the chroot restrictions via unspecified vectors.
    (CVE-2011-4099)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

capsh did not chdir('/') after calling chroot(). Programs could therefore access the current directory outside of the chroot (CVE-2011-4099).

The libcap packages provide a library and tools for getting and setting POSIX capabilities.

It was found that capsh did not change into the new root when using the '--chroot' option. An application started via the 'capsh --chroot' command could use this flaw to escape the chroot restrictions.
(CVE-2011-4099)

This update also fixes the following bug :

  - Previously, the libcap packages did not contain the     capsh(1) manual page. With this update, the capsh(1)     manual page is included.

All libcap users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

A vulnerability has been discovered and corrected in libcap :

capsh did not chdir(/) after calling chroot(). Programs could therefore access the current directory outside of the chroot (CVE-2011-4099).

The updated packages have been patched to correct this issue.

The following bug has been fixed :

  - capsh did not chdir('/') after calling chroot().
    Programs could therefore access the current directory     outside of the chroot. (CVE-2011-4099)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1694 advisory.

    The libcap packages provide a library and tools for getting and setting     POSIX capabilities.

    It was found that capsh did not change into the new root when using the
    --chroot option. An application started via the capsh --chroot command     could use this flaw to escape the chroot restrictions. (CVE-2011-4099)

    This update also fixes the following bug:

    * Previously, the libcap packages did not contain the capsh(1) manual page.
    With this update, the capsh(1) manual page is included. (BZ#730957)

    All libcap users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
181053	Oracle Linux 6 : libcap (ELSA-2011-1694)	Nessus	Oracle Linux Local Security Checks	medium
75892	openSUSE Security Update : libcap (openSUSE-SU-2011:1259-1)	Nessus	SuSE Local Security Checks	medium
75571	openSUSE Security Update : libcap (openSUSE-SU-2011:1259-1)	Nessus	SuSE Local Security Checks	medium
61191	Scientific Linux Security Update : libcap on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57145	Mandriva Linux Security Advisory : libcap (MDVSA-2011:185)	Nessus	Mandriva Local Security Checks	medium
57113	SuSE 11.1 Security Update : libcap (SAT Patch Number 5380)	Nessus	SuSE Local Security Checks	medium
57020	RHEL 6 : libcap (RHSA-2011:1694)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-4099

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium