PT-2009-6315 · Freebsd · Freebsd

Publicado 2009-12-02 · Atualizado 2019-05-22 · CVE-2009-4147

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 7.1 through 8.0

Description The issue concerns the rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c. It does not clear certain environment variables, including LD LIBMAP, LD LIBRARY PATH, LD LIBMAP DISABLE, LD DEBUG, and LD ELF HINTS PATH. This allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library.

Recommendations For FreeBSD versions 7.1 through 8.0, consider clearing the LD LIBMAP, LD LIBRARY PATH, LD LIBMAP DISABLE, LD DEBUG, and LD ELF HINTS PATH environment variables before executing setuid or setguid programs to prevent exploitation. As a temporary workaround, restrict the use of setuid and setguid programs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-4147

Produtos afetados

Freebsd

Referências · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb · Exploit
• 🔥 http://securityfocus.com/bid/37154 · Exploit
• 🔥 https://exploit-db.com/exploits/10255 · Exploit
• http://people.freebsd.org/~cperciva/rtld.patch · Correção
• http://secunia.com/advisories/37517 · Aviso do Fabricante
• http://securitytracker.com/id?1023250 · Correção
• http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4147 · Nota de Segurança
• http://securityfocus.com/archive/1/508146/100/0/threaded · Nota
• http://securityfocus.com/archive/1/508142/100/0/threaded · Nota