PT-2009-6315 · Freebsd · Freebsd

Published 2009-12-02 · Updated 2019-05-22 · CVE-2009-4147

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeBSD versions 7.1 through 8.0

Description The issue concerns the rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c. It does not clear certain environment variables, including LD LIBMAP, LD LIBRARY PATH, LD LIBMAP DISABLE, LD DEBUG, and LD ELF HINTS PATH. This allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library.

Recommendations For FreeBSD versions 7.1 through 8.0, consider clearing the LD LIBMAP, LD LIBRARY PATH, LD LIBMAP DISABLE, LD DEBUG, and LD ELF HINTS PATH environment variables before executing setuid or setguid programs to prevent exploitation. As a temporary workaround, restrict the use of setuid and setguid programs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4147

Affected Products

Freebsd

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/freebsd/local/rtld_execl_priv_esc.rb · Exploit
• 🔥 http://securityfocus.com/bid/37154 · Exploit
• 🔥 https://exploit-db.com/exploits/10255 · Exploit
• http://people.freebsd.org/~cperciva/rtld.patch · Patch
• http://secunia.com/advisories/37517 · Vendor Advisory
• http://securitytracker.com/id?1023250 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-4147 · Security Note
• http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html · Note
• http://securityfocus.com/archive/1/508146/100/0/threaded · Note
• http://securityfocus.com/archive/1/508142/100/0/threaded · Note