PT-2019-4352 · Gnu+1 · Gnulib+1

Ilya Smith · Publicado 2019-07-15 · Atualizado 2026-06-05 · CVE-2019-1010023

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Libc (affected versions not specified)

Description The issue is related to the libld component of the GNU Libc library, which provides system calls and basic functions. It is associated with insufficient input validation, allowing a remote attacker to execute arbitrary code using a specially crafted ELF file. The attack vector involves sending two ELF files to the victim and asking them to run ldd on it, which executes code. Note that upstream comments indicate this is being treated as a non-security bug and no real threat.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-264

CWE-20

Identificadores relacionados

BDU:2020-00072

CVE-2019-1010023

ECHO-BBE7-403A-C07E

Produtos afetados

Debian

Gnulib

Referências · 20

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=22851 · Exploit
• https://sourceware.org/ml/libc-alpha/2019-12/msg00018.html · Nota
• https://t.me/defcon_news/19144 · Publicação no Telegram
• https://exploit.kitploit.com/2019/07/dameware-remote-support-1200509-buffer.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010023 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00072 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-1010023 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-1010023 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010023 · Nota de Segurança
• https://t.me/cvenotify/89103 · Publicação no Telegram
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2019-1010023 · Aviso do Fabricante
• https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS · Nota
• https://sourceware.org/bugzilla/show_bug.cgi?id=22851#c7 · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-1010023 · Aviso do Fabricante
• http://securityfocus.com/bid/109167 · Nota