PT-2010-4770 · Mono · Mono-Debugger

Raphael Geissert · Published 2010-10-20 · Updated 2010-12-14 · CVE-2010-3369

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mono-debugger versions 2.4.3 through 2.8.1

Description The issue allows local users to gain privileges via a Trojan horse shared library in the current working directory. This is due to the mdb and mdb-symbolreader scripts placing a zero-length directory name in the LD LIBRARY PATH.

Recommendations For versions 2.4.3 through 2.8.1, update to version 2.8.1 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2010-3369

Affected Products

Mono-Debugger

References · 5

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598299 · Exploit
• http://secunia.com/advisories/42348 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3369 · Security Note
• https://bugzilla.novell.com/show_bug.cgi?id=647353 · Note
• http://mono-project.com/Vulnerabilities#mono-debugger_Insecure_Use_of_LD_LIBRARY_PATH · Note