Directory traversal

The 1 proofserv, 2 xrdcp, 3 xrdpwdadmin, and 4 xrd scripts in ROOT 5.18/00 place a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

CVE-2010-3376

CVE-2010-3376 affects ROOT 5.18/00 components: (1) proofserv, (2) xrdcp, (3) xrdpwdadmin, and (4) xrd scripts. The flaw places a zero-length directory name into LD_LIBRARY_PATH, enabling local privilege escalation via a Trojan horse shared library in the current working directory. Exploitation st...