Description
The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LD_PRELOAD or LD_LIBRARY_PATH.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- ProFTPd 1.2 pre6 - 'snprintf' Remote Root EDB-19503 · remote · Sep 17, 1999 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- glibc-ld-unsetenv(5173) vdb-entry
- 19990917 A few bugs... mailing-list
- 20000924 glibc locale security problem vendor-advisory
- 20000906 [slackware-security]: glibc 2.1.3 vulnerabilities patched mailing-list
- RHSA-2000:057 vendor-advisory
- MDKSA-2000:045 vendor-advisory
- 20000902 Conectiva Linux Security Announcement - glibc mailing-list
- 1639 vdb-entry
- TLSA2000020-1 vendor-advisory
- 20000902 glibc: local root exploit vendor-advisory
- 20000831 glibc unsetenv bug mailing-list
- 20000905 Conectiva Linux Security Announcement - glibc mailing-list
- 648 vdb-entry
- CSSA-2000-028.0 vendor-advisory
- MDKSA-2000:040 vendor-advisory