VULHUB ™

glibc is the C Library distributed with most implementations of the Linux Operating System. It is freely available through the Free Software Foundation, and publicly maintained. A problem in versions of glibc 2.1.9 and greater allow a local user access to restricted files. A typo in the glibc source creates a situation of insufficent validation and clearing of the environment variable RESOLV_HOST_CONF, a controlled environment variable that is normally cleared when suid/sgid programs are executed. Therefore, it is possible for a local user to set this environment variable to a sensitive system file and gain read privileges to the file. This vulnerability makes it possible for a user with malicious intent to read the shadow file, and gain access to encrypted passwords. Successful exploitation of this vulnerability could lead to compromise of system accounts, elevated privileges, and potentially administrative access.

glibc is the C Library distributed with most implementations of the Linux Operating System. It is freely available through the Free Software Foundation, and publicly maintained. A problem in versions of glibc 2.1.9 and greater allow a local user access to restricted files. A typo in the glibc source creates a situation of insufficent validation and clearing of the environment variable RESOLV_HOST_CONF, a controlled environment variable that is normally cleared when suid/sgid programs are executed. Therefore, it is possible for a local user to set this environment variable to a sensitive system file and gain read privileges to the file. This vulnerability makes it possible for a user with malicious intent to read the shadow file, and gain access to encrypted passwords. Successful exploitation of this vulnerability could lead to compromise of system accounts, elevated privileges, and potentially administrative access.