Back to search
CVE-2005-2072
Published: Jun 29, 2005
Modified: Aug 7, 2024
PUBLISHED
Description
The runtime linker (ld.so) in Solaris 8, 9, and 10 trusts the LD_AUDIT environment variable in setuid or setgid programs, which allows local users to gain privileges by (1) modifying LD_AUDIT to reference malicious code and possibly (2) using a long value for LD_AUDIT.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
ADV-2005-0908
vdb-entry
x_refsource_VUPEN
101794
vendor-advisory
x_refsource_SUNALERT
http://www.opensolaris.org/jive/thread.jspa?messageID=3497
x_refsource_CONFIRM
1014537
vdb-entry
x_refsource_SECTRACK
20050628 Solaris 9/10 ld.so fun
mailing-list
x_refsource_FULLDISC
15841
third-party-advisory
x_refsource_SECUNIA
14074
vdb-entry
x_refsource_BID
20050628 Solaris 9/10 ld.so fun
mailing-list
x_refsource_FULLDISC
20050628 Solaris 9/10 ld.so fun
mailing-list
x_refsource_FULLDISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now