|
Source: H Security - Posted by Alex
|
An exploit for FreeBSD is in circulation that allows users with restricted access to escalate their privileges to root level. The problem is caused by a flaw in the run-time link editor (rtld) which, in certain circumstances, accepts specially crafted environment variables. According to Kingcope, the developer of the exploit, the flaw is "incredibly easy" to exploit by, for example, setting a path to a specially crafted library for the LD_PRELOAD environment variable and then starting an SUID program like Ping.
LD_PRELOAD instructs the loader to load additional libraries when starting a program – regardless of what was specified during compilation. The library will be executed at the same privilege level as the SUID program. As a consequence, SUID programs tend to ignore user-defined environment variables like LD_PRELOAD for security reasons.
An attacker could, for instance, exploit the hole to compromise an entire server via vulnerabilities in web applications which would normally run at a restricted privilege level. FreeBSD 8.0-RELEASE and FreeBSD 7.1-RELEASE are affected. FreeBSD 6.3-RELEASE and FreeBSD 4.9-RELEASE are not vulnerable.
Read this full article at H Security
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
