PT-2019-4352 · Gnu+1 · Gnulib+1

Ilya Smith · Published 2019-07-15 · Updated 2026-05-04 · CVE-2019-1010023

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU Libc (affected versions not specified)

Description The issue is related to the libld component of the GNU Libc library, which provides system calls and basic functions. It is associated with insufficient input validation, allowing a remote attacker to execute arbitrary code using a specially crafted ELF file. The attack vector involves sending two ELF files to the victim and asking them to run ldd on it, which executes code. Note that upstream comments indicate this is being treated as a non-security bug and no real threat.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-264

CWE-20

Related Identifiers

BDU:2020-00072

CVE-2019-1010023

ECHO-BBE7-403A-C07E

Affected Products

Debian

Gnulib

References · 20

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=22851 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1010023 · Security Note
• https://cve.org/CVERecord?id=CVE-2019-1010023 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2019-1010023 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-1010023 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-1010023 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00072 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1010023 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-1010023 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-1010023 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2019-1010023 · Vendor Advisory
• https://exploit.kitploit.com/2019/07/dameware-remote-support-1200509-buffer.html · Note
• https://twitter.com/gcpweekly/status/1852765332483477859 · Twitter Post
• https://sourceware.org/bugzilla/show_bug.cgi?id=22851#c7 · Note
• https://t.me/defcon_news/19144 · Telegram Post