CVE-2006-6164

Description

The _dl_unsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LD_PRELOAD to loading processes, which might be leveraged to gain privileges.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/30441

http://www.securityfocus.com/bid/21188

http://www.securityfocus.com/archive/1/452428/100/0/threaded

http://www.securityfocus.com/archive/1/452371/100/0/threaded

http://www.openbsd.org/errata39.html#ldso

http://www.openbsd.org/errata.html#ldso

http://www.matasano.com/log/592/finger-79tcp-mcdonald-dowd-and-schuh-challenge-part-2/

http://securitytracker.com/id?1017253

http://secunia.com/advisories/22993

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS