Vulnerability Note VU#686403

Overview

ld.so fails to unset LD_PRELOAD before executing suid root programs, allowing loading of insecure or malicious libraries.

Description

ld.so, the UNIX/LINUX dynamic loader, fails in some conditions (and some operating system releases) to unset LD_PRELOAD before loading suid root programs for execution. Even though setuid root programs ignore LD_PRELOAD, programs called from suid root programs would use LD_PRELOAD and be loaded with insecure or malicious libraries and executed as root.

Impact

By altering LD_PRELOAD, attackers could cause malicious libraries to be loaded by programs called from setuid root programs, which then could execute arbitrary code as root.

Solution

Apply vendor patches; see the Systems Affected section below.

Systems Affected (Learn More)

Vendor	Status	Date Notified	Date Updated
Caldera	Affected	30 Aug 2000	15 May 2001
FreeBSD	Affected	08 Sep 2000	15 May 2001
MandrakeSoft	Affected	30 Aug 2000	15 May 2001
TurboLinux	Affected	19 Feb 2001	15 May 2001
Apple	Not Affected	08 Sep 2000	15 May 2001
Compaq Computer Corporation	Not Affected	08 Sep 2000	15 May 2001
Fujitsu	Not Affected	08 Sep 2000	15 May 2001
Hewlett Packard	Not Affected	08 Sep 2000	15 May 2001
Microsoft	Not Affected	08 Sep 2000	15 May 2001
OpenBSD	Not Affected	08 Sep 2000	15 May 2001
SCO	Not Affected	08 Sep 2000	15 May 2001
BSDI	Unknown	08 Sep 2000	15 May 2001
Data General	Unknown	08 Sep 2000	15 May 2001
IBM	Unknown	08 Sep 2000	15 May 2001
NCR	Unknown	08 Sep 2000	15 May 2001

If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group	Score	Vector
Base	N/A	N/A
Temporal	N/A	N/A
Environmental	N/A	N/A

References

• VU#386504 - similar vulnerability for glibc
• VU#2568 - rsh LD_PRELOAD vulnerability
• VU#5510 - replacing shared libraries at run-time
• http://www.securityfocus.com/vdb/bottom.html?vid=1639

Credit

The original public announcement was by Solar Designer <solar@false.com>.

This document was last modified by Tim Shimeall

Other Information

• CVE IDs: CVE-2000-0824
• Date Public: 31 Aug 2000
• Date First Published: 17 May 2001
• Date Last Updated: 21 Jun 2001
• Severity Metric: 6.73
• Document Revision: 6