glibc: ldd unexpected code execution issue

ldd in the GNU C Library aka glibc or libc6 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LDTRACELOADEDOBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion...

CVE-2009-5064

ldd in the GNU C Library aka glibc or libc6 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LDTRACELOADEDOBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion...

Sun Microsystems SunScreen Firewall - Privilege Escalation

/ Sun Microsystems SunScreen Firewall Root Exploit discovered & exploited by Kingcope January 2011 The SunScreen Firewall can be administrated remotely via a java protocol service which is running on port 3858 on a SunOS machine. This Java Service contains numerous buffer overruns 2 of which I am...

Sun Microsystems SunScreen Firewall - Privilege Escalation

Sun Microsystems SunScreen Firewall - Privilege Escalation / Sun Microsystems SunScreen Firewall Root Exploit discovered & exploited by Kingcope January 2011 The SunScreen Firewall can be administrated remotely via a java protocol service which is running on port 3858 on a SunOS machine. This Jav...

DEBIAN-CVE-2010-3847

elf/dl-load.c in ld.so in the GNU C Library aka glibc or libc6 through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LDAUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object DSO located in an arbitrary...

DEBIAN-CVE-2010-3856

ld.so in the GNU C Library aka glibc or libc6 before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LDAUDIT environment variable to reference dynamic shared objects DSOs as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a...

Mozilla unsafe library loading flaw

A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan hor...

DEBIAN-CVE-2010-3999

gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

glibc: ld.so arbitrary DSO loading via LD_AUDIT in setuid/setgid programs

ld.so in the GNU C Library aka glibc or libc6 before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LDAUDIT environment variable to reference dynamic shared objects DSOs as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a...

GNU C Library Dynamic Linker Arbitrary DSO dlopen

The GNU C library dynamic linker will dlopen arbitrary DSOs during setuid loads ------------------------------------------------------------------------------- Cześć, This advisory describes CVE-2010-3856, an addendum to CVE-2010-3847. Please see http://seclists.org/fulldisclosure/2010/Oct/257 fo...

glibc: ld.so insecure handling of $ORIGIN in LD_AUDIT for setuid/setgid programs

elf/dl-load.c in ld.so in the GNU C Library aka glibc or libc6 through 2.11.2, and 2.12.x through 2.12.1, does not properly handle a value of $ORIGIN for the LDAUDIT environment variable, which allows local users to gain privileges via a crafted dynamic shared object DSO located in an arbitrary...

DEBIAN-CVE-2010-3384

The 1 torcs, 2 nfsperf, 3 accc, 4 texmapper, 5 trackgen, and 6 nfs2ac scripts in TORCS 1.3.1 place a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

DEBIAN-CVE-2010-3394

The 1 texmacs and 2 tmmupadhelp scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

UBUNTU-CVE-2010-3393

magics-config in Magics++ 2.10.0 places a zero-length directory name in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

UBUNTU-CVE-2010-3380

The 1 init.d/slurm and 2 init.d/slurmdbd scripts in SLURM before 2.1.14 place the . dot directory in the LDLIBRARYPATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory...

FreeBSD Security Advisory (FreeBSD-SA-09:16.rtld.asc)

The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-09:16.rtld.asc SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

FreeBSD ld-elf本地权限提升漏洞

FreeBSD是一款开放源代码的基于BSD的操作系统。 在ld-elf对环境变量处理存在本地权限提升漏洞 FreeBSD包含的Run-Time Link-Editor rtld存在问题，本地攻击者可以利用漏洞获得root特权。 一般情况下，在执行类似"ping"或"su" setugid的程序时，RTLD不允许设置类似LDPRELOAD这类的危险环境变量，不过存在漏洞可让rtld被诱使在setugid程序上接收LD变量，导致特权提升。 FreeBSD 8.0-RELEASE FreeBSD 7.1-RELEASE 厂商解决方案 目前没有解决方案提供：...

Ordinary users by udev vulnerability to elevate to root permissions demo-vulnerability warning-the black bar safety net

Recently exposed by the udev permissions hint of vulnerability, as long as with normal user permissions, you can elevate to root privileges, the experiment a handful, really easy to upgrade. Put the following code saved as test. sh file !/ bin/sh Linux 2.6 bug found by Sebastian Krahmer lame splo...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

No description provided by source. !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD technique by kcope in 2009 tested on debian-etch,ubuntu,gentoo do a 'cat /proc/net/netlink' and set the first arg to this script to the pid of the netlink socket the pid is udevdpid - 1 most ...

Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit

Exploit for linux platform in category local exploits ======================================================== Linux Kernel 2.6 UDEV Local Privilege Escalation Exploit ======================================================== !/bin/sh Linux 2.6 bug found by Sebastian Krahmer lame sploit using LD...