Vulnerability Note VU#686403
ld.so fails to unset LD_PRELOAD before executing suid root programs
ld.so fails to unset LD_PRELOAD before executing suid root programs, allowing loading of insecure or malicious libraries.
ld.so, the UNIX/LINUX dynamic loader, fails in some conditions (and some operating system releases) to unset LD_PRELOAD before loading suid root programs for execution. Even though setuid root programs ignore LD_PRELOAD, programs called from suid root programs would use LD_PRELOAD and be loaded with insecure or malicious libraries and executed as root.
By altering LD_PRELOAD, attackers could cause malicious libraries to be loaded by programs called from setuid root programs, which then could execute arbitrary code as root.
Apply vendor patches; see the Systems Affected section below.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Caldera||Affected||30 Aug 2000||15 May 2001|
|FreeBSD||Affected||08 Sep 2000||15 May 2001|
|MandrakeSoft||Affected||30 Aug 2000||15 May 2001|
|TurboLinux||Affected||19 Feb 2001||15 May 2001|
|Apple||Not Affected||08 Sep 2000||15 May 2001|
|Compaq Computer Corporation||Not Affected||08 Sep 2000||15 May 2001|
|Fujitsu||Not Affected||08 Sep 2000||15 May 2001|
|Hewlett Packard||Not Affected||08 Sep 2000||15 May 2001|
|Microsoft||Not Affected||08 Sep 2000||15 May 2001|
|OpenBSD||Not Affected||08 Sep 2000||15 May 2001|
|SCO||Not Affected||08 Sep 2000||15 May 2001|
|BSDI||Unknown||08 Sep 2000||15 May 2001|
|Data General||Unknown||08 Sep 2000||15 May 2001|
|IBM||Unknown||08 Sep 2000||15 May 2001|
|NCR||Unknown||08 Sep 2000||15 May 2001|
CVSS Metrics (Learn More)
- VU#386504 - similar vulnerability for glibc
- VU#2568 - rsh LD_PRELOAD vulnerability
- VU#5510 - replacing shared libraries at run-time
The original public announcement was by Solar Designer
This document was last modified by Tim Shimeall
- CVE IDs: CVE-2000-0824
- Date Public: 31 Aug 2000
- Date First Published: 17 May 2001
- Date Last Updated: 21 Jun 2001
- Severity Metric: 6.73
- Document Revision: 6
If you have feedback, comments, or additional information about this vulnerability, please send us email.