|
|
|
 |
Vulnerability Note VU#686403ld.so fails to unset LD_PRELOAD before executing suid root programsOverviewld.so fails to unset LD_PRELOAD before executing suid root programs, allowing loading of insecure or malicious libraries.I. Descriptionld.so, the UNIX/LINUX dynamic loader, fails in some conditions (and some operating system releases) to unset LD_PRELOAD before loading suid root programs for execution. Even though setuid root programs ignore LD_PRELOAD, programs called from suid root programs would use LD_PRELOAD and be loaded with insecure or malicious libraries and executed as root.II. ImpactBy altering LD_PRELOAD, attackers could cause malicious libraries to be loaded by programs called from setuid root programs, which then could execute arbitrary code as root.III. SolutionApply vendor patches; see the Systems Affected section below.Systems Affected
ReferencesVU#386504 - similar vulnerability for glibc The original public announcement was by Solar Designer <solar@false.com>. This document was last modified by Tim Shimeall
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||