| Name | CVE-2009-3736 |
| Source | CVE (at NVD; RH) |
| Description | ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file. |
| References | DSA-1958-1 |
| NVD severity | medium (attack range: local, user-initiated) |
| Debian Bugs | 559797, 559800, 559801, 559803, 559806, 559808, 559809, 559811, 559813, 559814, 559815, 559816, 559818, 559819, 559821, 559822, 559823, 559824, 559825, 559826, 559827, 559828, 559829, 559831, 559832, 559833, 559834, 559835, 559836, 559837, 559840, 559843, 559844, 559845 |
| Debian/oldstable | packages babel, camserv, clamav, collectd, cvsnt, ggobi, gnash, gnu-smalltalk, graphicsmagick, guile-1.6, hercules, hypre, lam, libannodex, libextractor, libtunepimp, mp4h, naim, openmpi, pinball, sdcc, siproxd, synfig are vulnerable. |
| Debian/stable | not vulnerable. |
| Debian/testing | not vulnerable. |
| Debian/unstable | package ski is vulnerable. |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| arts (PTS) | lenny | 1.5.9-2 | fixed |
| squeeze | 1.5.9-3 | fixed | |
| babel (PTS) | lenny | 1.2.0.dfsg-6 | vulnerable |
| squeeze, wheezy, sid | 1.4.0.dfsg-8 | fixed | |
| bochs (PTS) | lenny | 2.3.7-1 | fixed |
| squeeze | 2.4.5-1 | fixed | |
| wheezy, sid | 2.4.6-4 | fixed | |
| camserv (PTS) | lenny | 1:0.5.1-7 | vulnerable |
| clamav (PTS) | lenny, lenny (security) | 0.94.dfsg.2-1lenny2 | vulnerable |
| squeeze | 0.97.3+dfsg-1~squeeze1 | fixed | |
| wheezy, sid | 0.97.3+dfsg-2 | fixed | |
| collectd (PTS) | lenny, lenny (security) | 4.4.2-3+lenny1 | vulnerable |
| squeeze | 4.10.1-1+squeeze2 | fixed | |
| sid | 4.10.4-1 | fixed | |
| cvsnt (PTS) | lenny, lenny (security) | 2.5.03.2382-3.3+lenny1 | vulnerable |
| ggobi (PTS) | lenny | 2.1.7-1 | vulnerable |
| squeeze | 2.1.9~20091212-3 | fixed | |
| wheezy, sid | 2.1.10-4 | fixed | |
| gnash (PTS) | lenny | 0.8.4-3~lenny1 | vulnerable |
| squeeze | 0.8.8-5 | fixed | |
| wheezy, sid | 0.8.10~git20111001-1.1 | fixed | |
| gnu-smalltalk (PTS) | lenny | 3.0.3-2 | vulnerable |
| squeeze | 3.1-6 | fixed | |
| wheezy, sid | 3.2.4-2 | fixed | |
| graphicsmagick (PTS) | lenny, lenny (security) | 1.1.11-3.2+lenny1 | vulnerable |
| squeeze | 1.3.12-1 | fixed | |
| wheezy, sid | 1.3.12-1.1 | fixed | |
| guile-1.6 (PTS) | lenny | 1.6.8-6.3 | vulnerable |
| squeeze, wheezy, sid | 1.6.8-10 | fixed | |
| hamlib (PTS) | lenny | 1.2.7.1-1+lenny1 | fixed |
| squeeze | 1.2.11-1 | fixed | |
| wheezy, sid | 1.2.14-1 | fixed | |
| heartbeat (PTS) | lenny | 2.1.3-6lenny4 | vulnerable |
| squeeze | 1:3.0.3-2 | fixed | |
| wheezy, sid | 1:3.0.5-3 | fixed | |
| hercules (PTS) | lenny | 3.05-2 | vulnerable |
| squeeze | 3.07-2 | fixed | |
| wheezy, sid | 3.07-2.2 | fixed | |
| hypre (PTS) | lenny | 2.0.0.dfsg-7 | vulnerable |
| squeeze, wheezy | 2.4.0b-7 | fixed | |
| sid | 2.8.0b-1 | fixed | |
| imagemagick (PTS) | lenny (security) | 7:6.3.7.9.dfsg2-1~lenny3 | fixed |
| lenny | 7:6.3.7.9.dfsg2-1~lenny4 | fixed | |
| squeeze | 8:6.6.0.4-3 | fixed | |
| wheezy, sid | 8:6.6.9.7-5 | fixed | |
| experimental | 8:6.7.4.0-1 | fixed | |
| jags (PTS) | squeeze | 2.0.0-1 | fixed |
| wheezy, sid | 3.2.0-1 | fixed | |
| kdelibs (PTS) | lenny, lenny (security) | 4:3.5.10.dfsg.1-0lenny4 | fixed |
| squeeze | 4:3.5.10.dfsg.1-5 | fixed | |
| lam (PTS) | lenny | 7.1.2-1.4 | vulnerable |
| squeeze, wheezy, sid | 7.1.2-2 | fixed | |
| libannodex (PTS) | lenny | 0.7.3-3.1 | vulnerable |
| libextractor (PTS) | lenny | 0.5.20c-1 | vulnerable |
| squeeze | 1:0.5.23+dfsg-7 | fixed | |
| wheezy, sid | 1:0.5.23+dfsg-7.1 | fixed | |
| experimental | 1:0.6.3-1 | fixed | |
| libmcrypt (PTS) | lenny | 2.5.7-5 | fixed |
| squeeze, wheezy, sid | 2.5.8-3.1 | fixed | |
| libprelude (PTS) | lenny | 0.9.18.1-1 | fixed |
| squeeze | 1.0.0-1 | fixed | |
| wheezy, sid | 1.0.0-7 | fixed | |
| libtool (PTS) | lenny, lenny (security) | 1.5.26-4+lenny1 | fixed |
| squeeze | 2.2.6b-2 | fixed | |
| wheezy, sid | 2.4.2-1 | fixed | |
| libtunepimp (PTS) | lenny | 0.5.3-7 | vulnerable |
| squeeze | 0.5.3-7.3 | fixed | |
| wheezy, sid | 0.5.3-7.5 | fixed | |
| mp4h (PTS) | lenny | 1.3.1-4 | vulnerable |
| squeeze | 1.3.1-5 | fixed | |
| wheezy, sid | 1.3.1-6 | fixed | |
| naim (PTS) | lenny | 0.11.8-1 | vulnerable |
| openmpi (PTS) | lenny | 1.2.7~rc2-2 | vulnerable |
| squeeze | 1.4.2-4 | fixed | |
| wheezy, sid | 1.4.3-2.1 | fixed | |
| experimental | 1.5.4-2~exp1 | fixed | |
| parser (PTS) | squeeze | 3.4.0-2 | fixed |
| wheezy, sid | 3.4.1-3 | fixed | |
| parser-mysql (PTS) | squeeze | 10.3-2 | fixed |
| wheezy, sid | 10.3-6 | fixed | |
| pdsh (PTS) | lenny | 2.16-1 | fixed |
| squeeze | 2.18-8 | fixed | |
| wheezy, sid | 2.27-1 | fixed | |
| pinball (PTS) | lenny | 0.3.1-7 | vulnerable |
| squeeze | 0.3.1-13 | fixed | |
| wheezy, sid | 0.3.1-13.1 | fixed | |
| proftpd-dfsg (PTS) | lenny | 1.3.1-17lenny6 | fixed |
| lenny (security) | 1.3.1-17lenny9 | fixed | |
| squeeze, squeeze (security) | 1.3.3a-6squeeze4 | fixed | |
| wheezy, sid | 1.3.4a-1 | fixed | |
| redland (PTS) | lenny | 1.0.7-1 | fixed |
| squeeze | 1.0.10-3 | fixed | |
| wheezy, sid | 1.0.15-1 | fixed | |
| sdcc (PTS) | lenny | 2.8.0.dfsg-1 | vulnerable |
| sid | 2.9.0-5 | fixed | |
| siproxd (PTS) | lenny | 1:0.7.0-2 | vulnerable |
| sid | 1:0.8.1-2 | fixed | |
| ski (PTS) | sid | 1.3.2-4 | vulnerable |
| synfig (PTS) | lenny | 0.61.08-3 | vulnerable |
| squeeze | 0.62.00-2 | fixed | |
| xmlsec1 (PTS) | lenny, lenny (security) | 1.2.9-5+lenny1 | vulnerable |
| squeeze, squeeze (security) | 1.2.14-1+squeeze1 | fixed | |
| wheezy, sid | 1.2.14-1.2 | fixed |
The information above is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| arts | source | (unstable) | (not affected) | |||
| babel | source | (unstable) | 1.4.0.dfsg-5 | low | 559843 | |
| bochs | source | (unstable) | (not affected) | |||
| camserv | source | (unstable) | (unfixed) | low | 559800 | |
| clamav | source | (unstable) | 0.95+dfsg-1 | low | 559832 | |
| collectd | source | (unstable) | 4.8.2-1 | low | 559801 | |
| cvsnt | source | (unstable) | 2.5.04.3236-1.2 | low | 559803 | |
| ggobi | source | (unstable) | 2.1.9~20091212-1 | low | 559806 | |
| gnash | source | (unstable) | 0.8.7-2 | low | 559808 | |
| gnu-smalltalk | source | (unstable) | 3.1-2 | low | 559809 | |
| graphicsmagick | source | (unstable) | 1.3.5-6 | low | 559811 | |
| guile-1.6 | source | (unstable) | 1.6.8-7 | low | 559813 | |
| hamlib | source | (unstable) | 1.2.10-1 | low | 559814 | |
| hamlib | source | lenny | 1.2.7.1-1+lenny1 | medium | ||
| heartbeat | source | (unstable) | 2.1.4-7 | unimportant | 559845 | |
| hercules | source | (unstable) | 3.06-1.2 | low | 559815 | |
| hypre | source | (unstable) | 2.4.0b-5 | low | 559834 | |
| imagemagick | source | (unstable) | 6:6.2.3.1-1 | low | 559833 | |
| jags | source | (unstable) | 1.0.4-1 | low | 559816 | |
| kdelibs | source | (unstable) | (not affected) | |||
| lam | source | (unstable) | 7.1.2-1.6 | low | 559835 | |
| libannodex | source | (unstable) | (unfixed) | low | 559818 | |
| libextractor | source | (unstable) | 0.5.23+dfsg-4 | low | 559819 | |
| libmcrypt | source | (unstable) | (not affected) | |||
| libprelude | source | (unstable) | 0.9.14-2 | low | 559844 | |
| libtool | source | (unstable) | 2.2.6b-1 | low | 559797 | |
| libtool | source | etch | 1.5.22-4+etch1 | medium | DSA-1958-1 | |
| libtool | source | lenny | 1.5.26-4+lenny1 | medium | DSA-1958-1 | |
| libtunepimp | source | (unstable) | 0.5.3-7.3 | low | 559821 | |
| mp4h | source | (unstable) | 1.3.1-4.1 | low | 559822 | |
| naim | source | (unstable) | (unfixed) | low | 559823 | |
| openmpi | source | (unstable) | 1.3.3-4 | low | 559836 | |
| parser | source | (unstable) | 3.4.0-2 | unimportant | 559837 | |
| parser-mysql | source | (unstable) | 10.3-2 | unimportant | 559824 | |
| pdsh | source | (unstable) | (not affected) | |||
| pinball | source | (unstable) | 0.3.1-11 | low | 559825 | |
| proftpd-dfsg | source | (unstable) | (not affected) | |||
| redland | source | (unstable) | 1.0.10-1 | low | 559826 | |
| redland | source | etch | (not affected) | |||
| redland | source | lenny | (not affected) | |||
| sdcc | source | (unstable) | 2.9.0-5 | low | 559840 | |
| siproxd | source | (unstable) | 1:0.8.1-1 | low | 559827 | |
| ski | source | (unstable) | (unfixed) | low | 559828 | |
| synfig | source | (unstable) | 0.62.00-1 | low | 559829 | |
| xmlsec1 | source | (unstable) | 1.2.14-1 | unimportant | 559831 |
- arts <not-affected> (Uses absolute path to the sound backend) - bochs <not-affected> (additional hardening in this package prevents this type of attack; bug #559799) requested camserv removal [lenny] - camserv <no-dsa> (Minor issue) [etch] - camserv <no-dsa> (Minor issue) [lenny] - collectd <no-dsa> (Minor issue) [etch] - collectd <no-dsa> (Minor issue) [etch] - cvsnt <no-dsa> (Minor issue) [lenny] - cvsnt <no-dsa> (Minor issue) [etch] - ggobi <no-dsa> (Minor issue) [lenny] - ggobi <no-dsa> (Minor issue) [lenny] - gnash <no-dsa> (Minor issue) [lenny] - gnu-smalltalk <no-dsa> (Minor issue) [etch] - gnu-smalltalk <no-dsa> (Minor issue) [lenny] - graphicsmagick <no-dsa> (Minor issue, can be fixed along with later updates) [etch] - graphicsmagick <no-dsa> (Minor issue, can be fixed along with later updates) [etch] - guile-1.6 <no-dsa> (Minor issue) [lenny] - guile-1.6 <no-dsa> (Minor issue) [etch] - hamlib <no-dsa> (Minor issue) [lenny] - hercules <no-dsa> (Minor issue) [etch] - hercules <no-dsa> (Minor issue) - kdelibs <not-affected> (dl_open open loads from fixed paths) [lenny] - libannodex <no-dsa> (Minor issue) [etch] - libannodex <no-dsa> (Minor issue) [etch] - libextractor <no-dsa> (Minor issue) [lenny] - libextractor <no-dsa> (Minor issue) - libmcrypt <not-affected> (not included in any of the binary packages; bug #559820) [lenny] - libtunepimp <no-dsa> (Minor issue) [etch] - libtunepimp <no-dsa> (Minor issue) [etch] - mp4h <no-dsa> (Minor issue) [lenny] - mp4h <no-dsa> (Minor issue) [lenny] - naim <no-dsa> (Minor issue) [etch] - naim <no-dsa> (Minor issue) [lenny] - pinball <no-dsa> (Minor issue) [etch] - pinball <no-dsa> (Minor issue) [etch] - redland <not-affected> (Versions prior to 1.0.9 don't use libtool/libltdl) [lenny] - redland <not-affected> (Versions prior to 1.0.9 don't use libtool/libltdl) [lenny] - siproxd <no-dsa> (Minor issue) [etch] - siproxd <no-dsa> (Minor issue) [lenny] - synfig <no-dsa> (Minor issue) Embedded code copy isn't used [lenny] - clamav <no-dsa> (Minor issue) [etch] - clamav <no-dsa> (Minor issue) [lenny] - imagemagick <no-dsa> (Minor issue) [etch] - imagemagick <no-dsa> (Minor issue) [etch] - hypre <no-dsa> (Minor issue) [lenny] - hypre <no-dsa> (Minor issue) [lenny] - lam <no-dsa> (Minor issue) [etch] - lam <no-dsa> (Minor issue) [lenny] - openmpi <no-dsa> (Minor issue) [etch] - openmpi <no-dsa> (Minor issue) users with write access can modify configuration to load new extensions, see #559837 - pdsh <not-affected> (Only loads from /usr/lib/pdsh, which is controlled by root) [lenny] - sdcc <no-dsa> (Minor issue) [etch] - sdcc <no-dsa> (Minor issue) - proftpd-dfsg <not-affected> (Only loads from /usr/lib/proftpd) [lenny] - babel <no-dsa> (Minor issue) [etch] - libprelude <no-dsa> (Minor issue) the dlopened path is always below /usr/lib/heartbeat, which isn't under control of an attacker From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze, might've been fixed earlier