CVE-2009-3736

Description

ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, as used in Ham Radio Control Libraries, Q, and possibly other products, attempts to open a .la file in the current working directory, which allows local users to gain privileges via a Trojan horse file.

6.9

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.10%

Vendor Advisory gentoo.org Vendor Advisory mandriva.com Vendor Advisory fedoraproject.org Vendor Advisory mandriva.com Vendor Advisory mandriva.com Vendor Advisory fedoraproject.org Vendor Advisory redhat.com Vendor Advisory fedoraproject.org Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory opensuse.org Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory redhat.com Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://security.gentoo.org/glsa/glsa-201311-10.xml	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:105	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035133.html	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:091	vendor advisory
http://support.avaya.com/css/P8/documents/100074869
ftp://ftp.gnu.org/gnu/libtool/libtool-2.2.6a-2.2.6b.diff.gz	patch
http://secunia.com/advisories/39299	third party advisory
http://secunia.com/advisories/38577	third party advisory
http://secunia.com/advisories/38617	third party advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:035	vendor advisory
http://secunia.com/advisories/37414	third party advisory vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=537941	patch
http://hamlib.svn.sourceforge.net/viewvc/hamlib/trunk/libltdl/Makefile.am?revision=2841&view=markup
http://secunia.com/advisories/55721	third party advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035168.html	vendor advisory
http://secunia.com/advisories/38190	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6951	signature vdb entry
http://git.savannah.gnu.org/cgit/libtool.git/commit/?h=branch-1-5&id=29b48580df75f0c5baa2962548a4c101ec7ed7ec	patch
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01512.html	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054921.html	vendor advisory
http://www.redhat.com/support/errata/RHSA-2010-0039.html	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:307	vendor advisory
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054656.html	vendor advisory
http://secunia.com/advisories/43617	third party advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054915.html	vendor advisory
http://lists.gnu.org/archive/html/libtool/2009-11/msg00059.html	patch mailing list
http://www.vupen.com/english/advisories/2011/0574	vdb entry
http://www.securityfocus.com/bid/37128	patch vdb entry
http://lists.gnu.org/archive/html/libtool/2009-11/msg00065.html	patch mailing list
http://secunia.com/advisories/37489	third party advisory vendor advisory
http://secunia.com/advisories/39347	third party advisory
https://rhn.redhat.com/errata/RHSA-2010-0095.html	vendor advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11687	signature vdb entry
http://secunia.com/advisories/38696	third party advisory
http://secunia.com/advisories/37997	third party advisory
http://secunia.com/advisories/38915	third party advisory

Frequently Asked Questions

What is the severity of CVE-2009-3736?: CVE-2009-3736 has been scored as a medium severity vulnerability.
How to fix CVE-2009-3736?: To fix CVE-2009-3736, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-3736 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2009-3736 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.