NVD Vulnerability Detail

CVE-2009-4146

Summary	The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1, 7.2, and 8.0 does not clear the LD_PRELOAD environment variable, which allows local users to gain privileges by executing a setuid or setguid program with a modified LD_PRELOAD variable containing an untrusted search path that points to a Trojan horse library, a different vector than CVE-2009-4147.
Summary	La función _rtld en el Run-Time Link-Editor (rtld) de libexec/rtld-elf/rtld.c de FreeBSD v7.1, v7.2 y v8.0, no limpia la variable de entorno LD_PRELOAD, esto permite a usuarios locales aumentar sus privilegios al ejecutar el programa setuid o setguid con la variable LD_PRELOAD modificada para que contenga una ruta de búsqueda no confiable que apunte a una biblioteca de un Troyano. Se trata de una vulnerabilidad diferente de CVE-2009-4147.
Publication Date	Dec. 3, 2009, 3:30 a.m.
Registration Date	Jan. 29, 2021, 1:26 p.m.
Last Update	April 23, 2026, 9:35 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource
1	http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html	cve@mitre.org
2	http://people.freebsd.org/~cperciva/rtld.patch	cve@mitre.org
3	http://secunia.com/advisories/37517	cve@mitre.org
4	http://www.securityfocus.com/archive/1/508142/100/0/threaded	cve@mitre.org
5	http://www.securityfocus.com/archive/1/508146/100/0/threaded	cve@mitre.org
6	http://www.securityfocus.com/archive/1/508168/100/0/threaded	cve@mitre.org
7	http://www.securityfocus.com/bid/37154	cve@mitre.org
8	http://www.securitytracker.com/id?1023250	cve@mitre.org
9	http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html	af854a3a-2127-422b-91ae-364da2661108
10	http://people.freebsd.org/~cperciva/rtld.patch	af854a3a-2127-422b-91ae-364da2661108
11	http://secunia.com/advisories/37517	af854a3a-2127-422b-91ae-364da2661108
12	http://www.securityfocus.com/archive/1/508142/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
13	http://www.securityfocus.com/archive/1/508146/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
14	http://www.securityfocus.com/archive/1/508168/100/0/threaded	af854a3a-2127-422b-91ae-364da2661108
15	http://www.securityfocus.com/bid/37154	af854a3a-2127-422b-91ae-364da2661108
16	http://www.securitytracker.com/id?1023250	af854a3a-2127-422b-91ae-364da2661108

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

FreeBSD の libexec/rtld-elf/rtld.c における権限を取得される脆弱性

Title	FreeBSD の libexec/rtld-elf/rtld.c における権限を取得される脆弱性
Summary	FreeBSD の libexec/rtld-elf/rtld.c の Run-Time Link-Editor (rtld) の _rtld 関数は、LD_PRELOAD 環境変数をクリアにしないため、権限を取得される脆弱性が存在します。本脆弱性は、CVE-2009-4147 とは異なる脆弱性です。
Possible impacts	ローカルユーザにより、トロイの木馬ライブラリを指す検索パスを含む変更された LD_PRELOAD 変数を伴う setuid プログラムまたは setguid プログラムを実行されることで、権限を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 2, 2009, midnight
Registration Date	June 26, 2012, 4:18 p.m.
Last Update	June 26, 2012, 4:18 p.m.

Affected System

FreeBSD

FreeBSD 5.3 7.1、7.2、および 8.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-4146	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4146
National Vulnerability Database (NVD)
2	CVE-2009-4146	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4146

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
FreeBSD
1	Index: rtld.c	http://people.freebsd.org/~cperciva/rtld.patch

Change Log

No	Changed Details	Date of change
0	[2012年06月26日] 掲載	Feb. 17, 2018, 10:37 a.m.