CVE-2015-3887: Untrusted Search Path (CWE-426)
value: Untrusted search path vulnerability in ProxyChains-NG before 4.9 allows local users to gain privileges via a Trojan horse libproxychains4.so library in the current working directory, which is referenced in the LD_PRELOAD path.
CWE description: The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CVSS v3 base score: 7.8
Published: 2017-09-21T16:29Z
Repository: https://github.com/rofl0r/proxychains-ng
Language: Other
Files changed: configure, src/main.c
Commit date: 2015-05-21 13:46:22 +0100
Commit message: fix for CVE-2015-3887

closes #60

Diff: diff --git a/configure b/configure
index fe1ad71..a4dac46 100755
--- a/configure
+++ b/configure
@@ -24,10 +24,13 @@ usage() {
 	echo "--exec_prefix=/path	default: $prefix/bin"
 	echo "--bindir=/path		default: $prefix/bin"
 	echo "--libdir=/path		default: $prefix/lib"
 	echo "--includedir=/path	default: $prefix/include"
 	echo "--sysconfdir=/path	default: $prefix/etc"
+	echo "--ignore-cve		default: no"
+	echo "	if set to yes ignores CVE-2015-3887 and makes it possible"
+	echo "	to preload from current dir (insecure)"
 	ismac && isx86_64 && echo "--fat-binary : build for both i386 and x86_64 architectures on 64-bit Macs"
 	echo "--help : show this text"
 	exit 1
 }
 
@@ -37,19 +40,21 @@ spliteq() {
 	#alternatives echo "$arg" | cut -d= -f2-
 	# or echo "$arg" | sed 's/[^=]*=//'
 }
 
 fat_binary=
-
+ignore_cve=no
 parsearg() {
 	case "$1" in
 	--prefix=*) prefix=`spliteq $1`;;
 	--exec_prefix=*) exec_prefix=`spliteq $1`;;
 	--bindir=*) bindir=`spliteq $1`;;
 	--libdir=*) libdir=`spliteq $1`;;
 	--includedir=*) includedir=`spliteq $1`;;
 	--sysconfdir=*) sysconfdir=`spliteq $1`;;
+	--ignore-cve) ignore_cve=1;;
+	--ignore-cve=*) ignore_cve=`spliteq $1`;;
 	--fat-binary) fat_binary=1;;
 	--help) usage;;
 	esac
 }
 
@@ -92,10 +97,11 @@ echo prefix=$prefix>>config.mak
 echo exec_prefix=$exec_prefix>>config.mak
 echo bindir=$bindir>>config.mak
 echo libdir=$libdir>>config.mak
 echo includedir=$includedir>>config.mak
 echo sysconfdir=$sysconfdir>>config.mak
+[ "$ignore_cve" = "no" ] && echo CPPFLAGS+= -DSUPER_SECURE>>config.mak
 make_cmd=make
 if ismac ; then
 	echo NO_AS_NEEDED=>>config.mak
 	echo LDSO_SUFFIX=dylib>>config.mak
 	echo MAC_CFLAGS+=-DIS_MAC=1>>config.mak
diff --git a/src/main.c b/src/main.c
index 4a79fb8..36e9eea 100644
--- a/src/main.c
+++ b/src/main.c
@@ -31,11 +31,13 @@ static int usage(char **argv) {
 
 static const char *dll_name = DLL_NAME;
 
 static char own_dir[256];
 static const char *dll_dirs[] = {
+#ifndef SUPER_SECURE /* CVE-2015-3887 */
 	".",
+#endif
 	own_dir,
 	LIB_DIR,
 	"/lib",
 	"/usr/lib",
 	"/usr/local/lib",
@@ -46,11 +48,15 @@ static const char *dll_dirs[] = {
 static void set_own_dir(const char *argv0) {
 	size_t l = strlen(argv0);
 	while(l && argv0[l - 1] != '/')
 		l--;
 	if(l == 0)
+#ifdef SUPER_SECURE
+		memcpy(own_dir, "/dev/null/", 2);
+#else
 		memcpy(own_dir, ".", 2);
+#endif
 	else {
 		memcpy(own_dir, argv0, l - 1);
 		own_dir[l] = 0;
 	}
 }

Fixed code: 	echo "--ignore-cve		default: no"
	echo "	if set to yes ignores CVE-2015-3887 and makes it possible"
	echo "	to preload from current dir (insecure)"
ignore_cve=no
	--ignore-cve) ignore_cve=1;;
	--ignore-cve=*) ignore_cve=`spliteq $1`;;
[ "$ignore_cve" = "no" ] && echo CPPFLAGS+= -DSUPER_SECURE>>config.mak
#ifndef SUPER_SECURE /* CVE-2015-3887 */
#endif
#ifdef SUPER_SECURE
		memcpy(own_dir, "/dev/null/", 2);
#else
#endif