PT-2000-1748 · Gnu · Glibc

Publicado 2000-11-14 · Atualizado 2017-10-10 · CVE-2000-0824

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions glibc version 2.1.1

Description The issue concerns the unsetenv function in glibc, which fails to properly unset an environmental variable if it is provided twice to a program. This could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables, such as LD PRELOAD or LD LIBRARY PATH.

Recommendations For glibc version 2.1.1, consider restricting the use of duplicate environmental variables to minimize the risk of exploitation. As a temporary workaround, avoid using the unsetenv function with duplicate variables until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2000-0824

Produtos afetados

Glibc

Referências · 17

• 🔥 https://exploit-db.com/exploits/19503 · Exploit
• 🔥 http://securityfocus.com/bid/648 · Exploit
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0525.html · Nota
• http://turbolinux.com/pipermail/tl-security-announce/2000-September/000020.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5173 · Nota
• http://linux-mandrake.com/en/updates/MDKSA-2000-040.php3 · Nota
• http://calderasystems.com/support/security/advisories/CSSA-2000-028.0.txt · Nota
• http://securityfocus.com/bid/1639 · Nota
• http://marc.info/?l=bugtraq&m=93760201002154&w=2 · Nota
• http://novell.com/linux/security/advisories/adv5_draht_glibc_txt.html · Nota
• http://securityfocus.com/archive/1/79537 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0436.html · Nota
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0509.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-0824 · Nota de Segurança
• http://debian.org/security/2000/20000902 · Nota