National Cyber Awareness System

Vulnerability Summary for CVE-2009-5064

Overview

** DISPUTED ** ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=682998

Type: Patch Information; Exploit

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=682998

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=531160

Type: Patch Information; Exploit

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=531160

External Source: MLIST

Name: [oss-security] 20110308 Re: ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/08/7

External Source: MLIST

Name: [oss-security] 20110308 Re: ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/08/3

External Source: MLIST

Name: [oss-security] 20110307 Re: ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/08/2

External Source: MLIST

Name: [oss-security] 20110308 Re: ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/08/10

External Source: MLIST

Name: [oss-security] 20110308 Re: ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/08/1

External Source: MLIST

Name: [oss-security] 20110307 ldd can execute an app unexpectedly

Type: Patch Information; Exploit

Hyperlink:http://openwall.com/lists/oss-security/2011/03/07/13

External Source: REDHAT

Name: RHSA-2011:1526

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-1526.html

External Source: MISC

Name: http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

Hyperlink:http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

External Source: MISC

Name: http://reverse.lostrealm.com/protect/ldd.html

Hyperlink:http://reverse.lostrealm.com/protect/ldd.html

External Source: MLIST

Name: [oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues

Hyperlink:http://openwall.com/lists/oss-security/2011/03/07/7

External Source: MLIST

Name: [oss-security] 20110307 Re: CVE Request -- logrotate -- nine issues

Hyperlink:http://openwall.com/lists/oss-security/2011/03/07/10