PT-2009-3070 · Trickle · Trickle

Josh Bressers · Publicado 2009-02-03 · Atualizado 2009-02-04 · CVE-2009-0415

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions trickle version 1.07

Description The issue allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD PRELOAD path. This is due to an untrusted search path vulnerability.

Recommendations For trickle version 1.07, consider restricting access to the LD PRELOAD path to prevent exploitation until a patch is available. As a temporary workaround, avoid using the LD PRELOAD path in sensitive environments. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2009-0415

Produtos afetados

Trickle

Referências · 7

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456 · Exploit
• https://osv.dev/vulnerability/CVE-2009-0415 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2009/01/29/5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0415 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0415 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2009-0415 · Aviso do Fabricante
• http://securityfocus.com/bid/33516 · Nota