| Vulnerability Name: | CVE-2009-4147 (CCN-54470) | ||||||||
| Assigned: | 2009-12-01 | ||||||||
| Published: | 2009-12-01 | ||||||||
| Updated: | 2019-05-22 | ||||||||
| Summary: | The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146. | ||||||||
| CVSS v3 Severity: | 9.3 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C) 6.1 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:TF/RC:C)
6.1 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:TF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-264 | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Nov 30 2009 - 16:12:20 CST FreeBSD local r00t zeroday Source: MITRE Type: CNA CVE-2009-4147 Source: CCN Type: FreeBSD-Announce Mailing List, Tue Dec 1 01:20:40 UTC 2009 Upcoming FreeBSD Security Advisory Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html Source: CONFIRM Type: Patch http://people.freebsd.org/~cperciva/rtld.patch Source: CCN Type: SA37517 FreeBSD Dynamic Linker Privilege Escalation Vulnerability Source: SECUNIA Type: Vendor Advisory 37517 Source: CCN Type: SECTRACK ID: 1023250 FreeBSD rtld Lets Local Users Gain Root Privileges Source: CCN Type: OSVDB ID: 60570 FreeBSD Dynamic Linker libexec/rtld-elf/rtld.c _rtld() Function Multiple Variable Local Privilege Escalation Source: BUGTRAQ Type: UNKNOWN 20091130 ** FreeBSD local r00t zeroday Source: BUGTRAQ Type: UNKNOWN 20091201 Upcoming FreeBSD Security Advisory Source: BID Type: Exploit 37154 Source: CCN Type: BID-37154 FreeBSD 'execl()' Local Privilege Escalation Vulnerability Source: SECTRACK Type: Patch 1023250 Source: XF Type: UNKNOWN freebsd-rtld-privilege-escalation(54470) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||