Debian glibc 2 symlink issue could allow arbitrary file overwriting

Overview Some versions of ld.so, the loader for shared libraries in UNIX/LINUX, do not properly clear risky environment variables, allowing a symlink attack to overwrite arbitrary files. Description LDDEBUGOUTPUT specifies a directory in which ld.so creates a file with a predictable name based on...

glibc unsetenv fails to properly handle environment variables passed more than once to a program

Overview The glibc implementation of unsetenv fails to properly remove one of two successive occurrences of the same environment variable if the variable is redundently passed to a program. Description The glibc implementation of unsetenv, if called to remove an environment variable that occurs t...

glibc does not check SUID bit on libraries in /etc/ld.so.cache

Overview The GNU libc library fails to perform a check for the SETUID bit for cached libraries in the /etc/ld.so.cache file. As a result, malicious users may create or modify privileged files. Description The GNU libc library allows preloading libraries via the LDPRELOAD environment variable,...

CVE-2001-0170

Technical specifics (affected product versions, root cause, mitigations, or exploit details) are not publicly provided in the supplied documents; monitor for updates.

CVE-2001-0169

CVE-2001-0169 : The GNU C Library (glibc) fails to verify that libraries loaded via LD_PRELOAD into SUID/SGID processes are also non-SUID/non-SGID when they come from /etc/ld.so.cache, enabling a local user to pre-load a library from /lib or /usr/lib and overwrite privileged files. Documented in ...

CVE-2001-0169

When using the LDPRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib...

CVE-2001-0170

glibc 2.1.9x and earlier does not properly clear the RESOLVHOSTCONF, HOSTALIASES, or RESOPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files...

CVE-2001-0170

glibc 2.1.9x and earlier does not properly clear the RESOLVHOSTCONF, HOSTALIASES, or RESOPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files...

CVE-2001-0169

When using the LDPRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib...

[SECURITY] [DSA-039-1] glibc local file overwrite problems

Package : glibc Problem type : local file overwrite Debian-specific: no The version of GNU libc that was distributed with Debian GNU/Linux 2.2 suffered from 2 security problems: It was possible to use LDPRELOAD to load libraries that are listed in /etc/ld.so.cache, even for suid programs. This...

GLIBC 2.1.3 ld_preload Local Exploit

Exploit for linux platform in category local exploits ==================================== GLIBC 2.1.3 ldpreload Local Exploit ==================================== !/bin/tcsh przyklad wykorzystania dziury w LDPRELOAD shadow tested on redhat 6.0, should work on others if -e /etc/initscript echo...

GLIBC 2.1.3 - LD_PRELOAD Local Privilege Escalation

GLIBC 2.1.3 - LDPRELOAD Local Privilege Escalation !/bin/tcsh przyklad wykorzystania dziury w LDPRELOAD shadow tested on redhat 6.0, should work on others if -e /etc/initscript echo uwaga: /etc/initscript istnieje cd /lib umask 0 setenv LDPRELOAD libSegFault.so setenv SEGFAULTOUTPUTNAME...

GLIBC 2.1.3 - 'LD_PRELOAD' Local Privilege Escalation

!/bin/tcsh przyklad wykorzystania dziury w LDPRELOAD shadow tested on redhat 6.0, should work on others if -e /etc/initscript echo uwaga: /etc/initscript istnieje cd /lib umask 0 setenv LDPRELOAD libSegFault.so setenv SEGFAULTOUTPUTNAME /etc/initscript echo czekaj... to moze chwile potrwac... whi...

glibc-resolve-tr.sh

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

glibc-2.2 openssh-2.3.0p1 glibc 2.1.9x - File Read

glibc-2.2 openssh-2.3.0p1 glibc 2.1.9x - File Read Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to...

glibc-2.2 and openssh-2.3.0p1 exploits glibc >= 2.1.9x

Exploit for linux platform in category local exploits ====================================================== glibc-2.2 and openssh-2.3.0p1 exploits glibc = 2.1.9x ====================================================== Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This...

glibc-2.2 / openssh-2.3.0p1 / glibc 2.1.9x - File Read

Charles Stevenson glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute FILE=/etc/shadow File to read echo "$ssh" echo " Checking permisions..." if...

CVE-2000-0824

The CVE-2000-0824 issue involves glibc 2.1.1 unsetenv(): when a variable appears twice in the environment, the value may not be properly removed, enabling a local attacker to influence setuid programs with duplicate variables (e.g., LD_PRELOAD, LD_LIBRARY_PATH) and potentially execute code as roo...

CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LDPRELOAD or...

Серьезная дырка в glibc

В suid-приложениях не сбрасывается переменная RESOLVHOSTCONF, что позволяет пользователю указать в качестве конфигурации резолвера любой файл, получить доступ на чтение к любому файлу. Кроме того, в отдельных случаях пользователь может подключать свои библиотеки...