PT-2009-3070 · Trickle · Trickle

Josh Bressers · Published 2009-02-03 · Updated 2009-02-04 · CVE-2009-0415

Positive Technologies (AI Summary)

CVSS v2.0

3.7

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions trickle version 1.07

Description The issue allows local users to execute arbitrary code via a Trojan horse trickle-overload.so in the current working directory, which is referenced in the LD PRELOAD path. This is due to an untrusted search path vulnerability.

Recommendations For trickle version 1.07, consider restricting access to the LD PRELOAD path to prevent exploitation until a patch is available. As a temporary workaround, avoid using the LD PRELOAD path in sensitive environments. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2009-0415

Affected Products

Trickle

References · 7

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513456 · Exploit
• https://osv.dev/vulnerability/CVE-2009-0415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0415 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-0415 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-0415 · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/01/29/5 · Note
• http://securityfocus.com/bid/33516 · Note