PT-2000-1748 · Gnu · Glibc

Published 2000-11-14 · Updated 2017-10-10 · CVE-2000-0824

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions glibc version 2.1.1

Description The issue concerns the unsetenv function in glibc, which fails to properly unset an environmental variable if it is provided twice to a program. This could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables, such as LD PRELOAD or LD LIBRARY PATH.

Recommendations For glibc version 2.1.1, consider restricting the use of duplicate environmental variables to minimize the risk of exploitation. As a temporary workaround, avoid using the unsetenv function with duplicate variables until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2000-0824

Affected Products

Glibc

References · 17

• 🔥 https://exploit-db.com/exploits/19503 · Exploit
• 🔥 http://securityfocus.com/bid/648 · Exploit
• http://securityfocus.com/archive/1/79537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2000-0824 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0525.html · Note
• http://turbolinux.com/pipermail/tl-security-announce/2000-September/000020.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5173 · Note
• http://linux-mandrake.com/en/updates/MDKSA-2000-040.php3 · Note
• http://calderasystems.com/support/security/advisories/CSSA-2000-028.0.txt · Note
• http://securityfocus.com/bid/1639 · Note
• http://marc.info/?l=bugtraq&m=93760201002154&w=2 · Note
• http://novell.com/linux/security/advisories/adv5_draht_glibc_txt.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0436.html · Note
• http://archives.neohapsis.com/archives/bugtraq/2000-08/0509.html · Note
• http://debian.org/security/2000/20000902 · Note