PT-2006-6798 · Openbsd · Openbsd

Published 2006-11-29 · Updated 2018-10-17 · CVE-2006-6164

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenBSD versions 3.9 through 4.0

Description The issue is related to the dl unsetenv function in loader.c in the ELF ld.so, which does not properly remove duplicate environment variables. This allows local users to pass dangerous variables, such as LD PRELOAD, to loading processes. This could potentially be leveraged to gain privileges.

Recommendations For OpenBSD versions 3.9 through 4.0, consider restricting the use of the LD PRELOAD variable to minimize the risk of exploitation. As a temporary workaround, avoid using the LD PRELOAD variable in sensitive environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-6164

Affected Products

Openbsd

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-6164 · Security Note
• http://securitytracker.com/id?1017253 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30441 · Note
• http://securityfocus.com/bid/21188 · Note
• http://securityfocus.com/archive/1/452371/100/0/threaded · Note
• http://openbsd.org/errata.html#ldso · Patch, Vendor Advisory
• http://securityfocus.com/archive/1/452428/100/0/threaded · Note
• http://secunia.com/advisories/22993 · Note
• http://openbsd.org/errata39.html#ldso · Patch, Vendor Advisory
• http://matasano.com/log/592/finger-79tcp-mcdonald-dowd-and-schuh-challenge-part-2 · Note