CVE-2005-2811 in net-snmp
Summary
by MITRE
untrusted search path vulnerability in net-snmp 5.2.1.2 and earlier on gentoo linux installs certain perl modules with an insecure dt_rpath which could allow local users to gain privileges.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/09/2019
The vulnerability identified as CVE-2005-2811 represents a critical untrusted search path issue affecting net-snmp versions 5.2.1.2 and earlier on Gentoo Linux systems. This flaw stems from the improper handling of dynamic shared object loading mechanisms within the SNMP implementation, specifically involving the use of insecure dt_rpath directives during the compilation and installation process of certain perl modules. The vulnerability creates a privilege escalation vector that can be exploited by local attackers who have access to the system.
The technical root cause of this vulnerability lies in the insecure runtime linking configuration that allows the system to search for shared libraries in directories specified by the dt_rpath attribute. When perl modules are installed with these insecure runtime paths, the system's dynamic linker may inadvertently load malicious shared objects from directories that are not properly secured or validated. This behavior violates fundamental security principles of least privilege and proper library isolation, as described in CWE-426. The insecure dt_rpath configuration essentially creates a situation where the system will search for libraries in predictable locations that an attacker can manipulate, leading to potential code injection or privilege escalation.
The operational impact of this vulnerability is significant for systems running affected net-snmp versions, particularly those with local user access. Attackers who can place malicious shared libraries in directories that are part of the dt_rpath search path can potentially execute arbitrary code with elevated privileges. This vulnerability aligns with ATT&CK technique T1068, which describes the exploitation of legitimate system tools for privilege escalation. The risk is particularly elevated in environments where multiple users have access to the system, as local users can leverage this flaw to gain unauthorized access to system resources or escalate their privileges to root level access. Systems that rely heavily on SNMP monitoring or management functions become particularly vulnerable since they often require elevated privileges to operate properly.
The exploitation of this vulnerability typically requires local system access and involves placing malicious shared libraries in directories that are part of the insecure search path. This attack vector can be particularly insidious because it leverages legitimate system components and processes, making detection more challenging. Organizations should consider implementing proper library path validation and ensuring that all system components are compiled with secure linking configurations. The vulnerability demonstrates the importance of proper build-time security configurations and highlights the need for regular security audits of installed software packages. Remediation involves upgrading to net-snmp versions that properly address the untrusted search path issue, ensuring that all perl modules are installed with secure runtime linking configurations, and implementing proper access controls to limit local user privileges where possible.