Synopsis:	Important: sblim security update
Issue date:	2008-06-24
CVE Names:	CVE-2008-1951

It was discovered that certain sblim libraries had an RPATH (runtime
library search path) set in the ELF (Executable and Linking Format) header.
This RPATH pointed to a sub-directory of a world-writable, temporary
directory. A local user could create a file with the same name as a library
required by sblim (such as libc.so) and place it in the directory defined
in the RPATH. This file could then execute arbitrary code with the
privileges of the user running an application that used sblim (eg
tog-pegasus). (CVE-2008-1951)

SL 4.x

     SRPMS:
sblim-1-13a.el4_6.1.src.rpm
     i386:
sblim-cmpi-base-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-base-devel-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-base-test-1.5.4-13a.el4_6.1.i386.rpm
sblim-cmpi-devel-1.0.4-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-fsvol-test-1.4.3-13a.el4_6.1.i386.rpm
sblim-cmpi-network-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-network-devel-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-network-test-1.3.7-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv3-1.0.13-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv3-test-1.0.13-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv4-1.0.11-13a.el4_6.1.i386.rpm
sblim-cmpi-nfsv4-test-1.0.11-13a.el4_6.1.i386.rpm
sblim-cmpi-params-1.2.4-13a.el4_6.1.i386.rpm
sblim-cmpi-params-test-1.2.4-13a.el4_6.1.i386.rpm
sblim-cmpi-sysfs-1.1.8-13a.el4_6.1.i386.rpm
sblim-cmpi-sysfs-test-1.1.8-13a.el4_6.1.i386.rpm
sblim-cmpi-syslog-0.7.9-13a.el4_6.1.i386.rpm
sblim-cmpi-syslog-test-0.7.9-13a.el4_6.1.i386.rpm
sblim-gather-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-devel-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-provider-2.1.1-13a.el4_6.1.i386.rpm
sblim-gather-test-2.1.1-13a.el4_6.1.i386.rpm
sblim-testsuite-1.2.4-13a.el4_6.1.i386.rpm
sblim-wbemcli-1.5.1-13a.el4_6.1.i386.rpm
     x86_64:
sblim-cmpi-base-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-base-devel-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-base-test-1.5.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-devel-1.0.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-devel-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-fsvol-test-1.4.3-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-devel-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-network-test-1.3.7-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv3-1.0.13-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv3-test-1.0.13-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv4-1.0.11-13a.el4_6.1.x86_64.rpm
sblim-cmpi-nfsv4-test-1.0.11-13a.el4_6.1.x86_64.rpm
sblim-cmpi-params-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-params-test-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-cmpi-sysfs-1.1.8-13a.el4_6.1.x86_64.rpm
sblim-cmpi-sysfs-test-1.1.8-13a.el4_6.1.x86_64.rpm
sblim-cmpi-syslog-0.7.9-13a.el4_6.1.x86_64.rpm
sblim-cmpi-syslog-test-0.7.9-13a.el4_6.1.x86_64.rpm
sblim-gather-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-devel-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-provider-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-gather-test-2.1.1-13a.el4_6.1.x86_64.rpm
sblim-testsuite-1.2.4-13a.el4_6.1.x86_64.rpm
sblim-wbemcli-1.5.1-13a.el4_6.1.x86_64.rpm

SL 5.x

     SRPMS:
sblim-1-31.el5_2.1.src.rpm
     i386:
sblim-cim-client-1.3.3-31.el5_2.1.i386.rpm
sblim-cim-client-javadoc-1-31.el5_2.1.i386.rpm
sblim-cim-client-manual-1-31.el5_2.1.i386.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-test-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.i386.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-dns-test-1-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-test-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-test-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv3-1.0.14-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv3-test-1.0.14-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv4-1.0.12-31.el5_2.1.i386.rpm
sblim-cmpi-nfsv4-test-1.0.12-31.el5_2.1.i386.rpm
sblim-cmpi-params-1.2.6-31.el5_2.1.i386.rpm
sblim-cmpi-params-test-1.2.6-31.el5_2.1.i386.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-samba-test-1-31.el5_2.1.i386.rpm
sblim-cmpi-sysfs-1.1.9-31.el5_2.1.i386.rpm
sblim-cmpi-sysfs-test-1.1.9-31.el5_2.1.i386.rpm
sblim-cmpi-syslog-0.7.11-31.el5_2.1.i386.rpm
sblim-cmpi-syslog-test-0.7.11-31.el5_2.1.i386.rpm
sblim-gather-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-test-2.1.2-31.el5_2.1.i386.rpm
sblim-testsuite-1.2.4-31.el5_2.1.i386.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.i386.rpm
sblim-wbemcli-1.5.1-31.el5_2.1.i386.rpm
     x86_64:
sblim-cim-client-1.3.3-31.el5_2.1.x86_64.rpm
sblim-cim-client-javadoc-1-31.el5_2.1.x86_64.rpm
sblim-cim-client-manual-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.i386.rpm
sblim-cmpi-base-devel-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-base-test-1.5.5-31.el5_2.1.x86_64.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.i386.rpm
sblim-cmpi-devel-1.0.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-dns-0.5.2-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-dns-devel-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-dns-test-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.i386.rpm
sblim-cmpi-fsvol-devel-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-fsvol-test-1.4.4-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.i386.rpm
sblim-cmpi-network-devel-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-network-test-1.3.8-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv3-1.0.14-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv3-test-1.0.14-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv4-1.0.12-31.el5_2.1.x86_64.rpm
sblim-cmpi-nfsv4-test-1.0.12-31.el5_2.1.x86_64.rpm
sblim-cmpi-params-1.2.6-31.el5_2.1.x86_64.rpm
sblim-cmpi-params-test-1.2.6-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.i386.rpm
sblim-cmpi-samba-0.5.2-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.i386.rpm
sblim-cmpi-samba-devel-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-samba-test-1-31.el5_2.1.x86_64.rpm
sblim-cmpi-sysfs-1.1.9-31.el5_2.1.x86_64.rpm
sblim-cmpi-sysfs-test-1.1.9-31.el5_2.1.x86_64.rpm
sblim-cmpi-syslog-0.7.11-31.el5_2.1.x86_64.rpm
sblim-cmpi-syslog-test-0.7.11-31.el5_2.1.x86_64.rpm
sblim-gather-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-devel-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.i386.rpm
sblim-gather-provider-2.1.2-31.el5_2.1.x86_64.rpm
sblim-gather-test-2.1.2-31.el5_2.1.x86_64.rpm
sblim-testsuite-1.2.4-31.el5_2.1.x86_64.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-0.2.3-31.el5_2.1.x86_64.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.i386.rpm
sblim-tools-libra-devel-0.2.3-31.el5_2.1.x86_64.rpm
sblim-wbemcli-1.5.1-31.el5_2.1.x86_64.rpm

-Connie Sieh
-Troy Dawson