Description
Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as gettext and catopen.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 11
- GLIBC locale - Format Strings EDB-249 · local · Jan 15, 2003 · verified
- GLIBC locale - bug mount EDB-215 · local · Dec 2, 2000 · verified
- GLIBC - '/bin/su' Local Privilege Escalation EDB-209 · local · Nov 30, 2000 · verified
- Solaris 2.6/7.0 - 'locale' Format Strings noexec stack Overflow EDB-210 · local · Nov 30, 2000 · verified
- Solaris/SPARC 2.7 / 7 locale - Format String EDB-197 · local · Nov 20, 2000 · verified
- Solaris 2.6/7.0 /locale - Subsystem Format String EDB-20186 · local · Nov 2, 2000 · verified
- Solaris 2.6/7.0 'eject' locale - Subsystem Format String EDB-20188 · local · Sep 8, 2000 · verified
- RedHat 6 GLIBC/locale - Subsystem Format String EDB-20185 · local · Sep 6, 2000 · verified
- Immunix OS 6.2 - LC glibc format string EDB-20187 · local · Sep 4, 2000 · verified
- Libc locale - Local Privilege Escalation (1) EDB-20189 · local · Sep 4, 2000 · verified
- Libc locale - Local Privilege Escalation (2) EDB-20190 · local · Sep 4, 2000 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- RHSA-2000:057 vendor-advisory
- 20000906 glibc locale security problem vendor-advisory
- 20000902 Conectiva Linux Security Announcement - glibc mailing-list
- SSRT0689U vendor-advisory
- TLSA2000020-1 vendor-advisory
- 20000902 glibc: local root exploit vendor-advisory
- 20000904 UNIX locale format string vulnerability mailing-list
- IY13753 vendor-advisory
- 1634 vdb-entry
- CSSA-2000-030.0 vendor-advisory
- unix-locale-format-string(5176) vdb-entry