1. Ubuntu Security Notices
  2. USN-1612-1

USN-1612-1: libgssglue vulnerability

Publication date

15 October 2012

Overview

Privilege escalation via the GSSAPI_MECH_CONF environment variable with setuid programs.

Releases

Packages

  • libgssglue - header files and docs for libgssglue

Details

It was discovered that libgssglue incorrectly handled the GSSAPI_MECH_CONF
environment variable when running a privileged binary. A local attacker could
exploit this to gain root privileges. (CVE-2011-2709)

It was discovered that libgssglue incorrectly handled the GSSAPI_MECH_CONF
environment variable when running a privileged binary. A local attacker could
exploit this to gain root privileges. (CVE-2011-2709)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
12.04 precise libgssglue1 –  0.3-4ubuntu0.1
11.10 oneiric libgssglue1 –  0.3-1ubuntu1.1
11.04 natty libgssglue1 –  0.1-4ubuntu1.1
10.04 lucid libgssglue1 –  0.1-4ubuntu0.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›