PT-2009-6314 · Freebsd · Freebsd

Published 2009-12-02 · Updated 2019-05-22 · CVE-2009-4146

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 7.1 through 8.0

Description The issue concerns the rtld function in the Run-Time Link-Editor (rtld) which does not clear the LD PRELOAD environment variable. This allows local users to gain privileges by executing a setuid or setguid program with a modified LD PRELOAD variable containing an untrusted search path that points to a Trojan horse library.

Recommendations For FreeBSD versions 7.1 through 8.0, consider clearing the LD PRELOAD environment variable before executing setuid or setguid programs to prevent exploitation. As a temporary workaround, restrict the use of setuid and setguid programs until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4146

Affected Products

Freebsd

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb · Exploit
• 🔥 http://people.freebsd.org/~cperciva/rtld.patch · Exploit
• 🔥 http://securityfocus.com/bid/37154 · Exploit
• 🔥 https://exploit-db.com/exploits/10255 · Exploit
• http://secunia.com/advisories/37517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4146 · Security Note
• http://securityfocus.com/archive/1/508168/100/0/threaded · Note
• http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html · Note
• http://securitytracker.com/id?1023250 · Note
• http://securityfocus.com/archive/1/508146/100/0/threaded · Note
• http://securityfocus.com/archive/1/508142/100/0/threaded · Note