CVE:CVE-2010-3351
CNNVD:CNNVD-201010-299
Bristol 0.60.5版本中的startBristol在LD_LIBRARY_PATH中放置了零长度的目录名称。本地用户可以借助在当前工作目录中的共享库文件的Trojan木马获得权限提升。
solution:Upgrade nick_copeland bristol to a higher version than 0.60.5,0.9.3,0.9.4-1,0.9.4-57,0.9.5-13,0.9.5-19,0.9.5-37,0.9.5-48,0.9.5-60,0.9.5-66,0.9.5-89,0.9.6-113,0.9.6-121,0.9.6-150,0.9.6-169,0.9.6-212,0.10.1,0.10.2,0.10.3,0.10.4,0.10.5,0.10.6,0.10.7,0.10.8,0.10.9,0.10.10,0.10.11,0.10.12,0.10.13,0.20.1,0.20.2,0.20.3,0.20.4,0.20.5,0.20.6,0.20.7,0.20.8,0.20.9,0.20.10,0.30.1,0.30.2,0.30.3,0.30.4,0.30.5,0.30.6,0.30.7,0.30.8,0.30.9,0.40.3,0.40.4,0.40.5,0.40.6,0.40.7,0.40.8,0.50.2,0.50.3,0.50.5,0.50.6,0.50.7,0.50.8,0.60.0,0.60.1,0.60.2,0.60.3,0.60.4,0.60.6,0.60.7,and avoid the version 0.60.5,0.9.3,0.9.4-1,0.9.4-57,0.9.5-13,0.9.5-19,0.9.5-37,0.9.5-48,0.9.5-60,0.9.5-66,0.9.5-89,0.9.6-113,0.9.6-121,0.9.6-150,0.9.6-169,0.9.6-212,0.10.1,0.10.2,0.10.3,0.10.4,0.10.5,0.10.6,0.10.7,0.10.8,0.10.9,0.10.10,0.10.11,0.10.12,0.10.13,0.20.1,0.20.2,0.20.3,0.20.4,0.20.5,0.20.6,0.20.7,0.20.8,0.20.9,0.20.10,0.30.1,0.30.2,0.30.3,0.30.4,0.30.5,0.30.6,0.30.7,0.30.8,0.30.9,0.40.3,0.40.4,0.40.5,0.40.6,0.40.7,0.40.8,0.50.2,0.50.3,0.50.5,0.50.6,0.50.7,0.50.8,0.60.0,0.60.1,0.60.2,0.60.3,0.60.4,0.60.6,0.60.7