NVD

Id
15192  
Name
CVE-2010-3856  
Description
ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2011-01-07  
Modified Date
2016-12-06  
Seq
2010-3856  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
85446 15192 CVE-2010-3856 20101022 The GNU C library dynamic linker will dlopen arbitrary DSOs during setuid loads.  View
85447 15192 CVE-2010-3856 GLSA-201011-01  View
85448 15192 CVE-2010-3856 [libc-hacker] 20101022 [PATCH] Require suid bit on audit objects in privileged programs  View
85449 15192 CVE-2010-3856 http://support.avaya.com/css/P8/documents/100121017  View
85450 15192 CVE-2010-3856 DSA-2122  View
85451 15192 CVE-2010-3856 MDVSA-2010:212  View
85452 15192 CVE-2010-3856 RHSA-2010:0872  View
85453 15192 CVE-2010-3856 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap  View
85454 15192 CVE-2010-3856 44347  View
85455 15192 CVE-2010-3856 USN-1009-1  View
85456 15192 CVE-2010-3856 http://www.vmware.com/security/advisories/VMSA-2011-0001.html  View
85457 15192 CVE-2010-3856 ADV-2011-0025  View
85458 15192 CVE-2010-3856 https://bugzilla.redhat.com/show_bug.cgi?id=645672  View
85459 15192 CVE-2010-3856 SUSE-SA:2010:052  View
85460 15192 CVE-2010-3856 RHSA-2010:0793  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36903 JVNDB-2010-002683 GNU C library の ld.so における権限昇格の脆弱性 GNU C library (glibc または libc6) の ld.so は、監査オブジェクトとして dynamic shared objects (DSOs) の参照を行う LD_AUDIT 環境変数の使用を適切に制限しないため、権限を取得される脆弱性が存在します。 CVE-2010-3856 46436 CVE-2010-3856 15192 7.2 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002683.html 2010-10-25 2011-01-25 View