Vulnerability Details : CVE-2009-4147
Public exploit exists!
The _rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LD_LIBMAP, (2) LD_LIBRARY_PATH, (3) LD_LIBMAP_DISABLE, (4) LD_DEBUG, and (5) LD_ELF_HINTS_PATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146.
Threat overview for CVE-2009-4147
Top countries where our scanners detected CVE-2009-4147
Top open port discovered on systems with this issue
80
IPs affected by CVE-2009-4147 1
Find out if you* are
affected by CVE-2009-4147!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-4147
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2009-4147
-
FreeBSD rtld execl() Privilege Escalation
Disclosure Date: 2009-11-30First seen: 2020-04-26exploit/freebsd/local/rtld_execl_priv_escThis module exploits a vulnerability in the FreeBSD run-time link-editor (rtld). The rtld `unsetenv()` function fails to remove `LD_*` environment variables if `__findenv()` fails. This can be abused to load arbitrary shared objects using
CVSS scores for CVE-2009-4147
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
CWE ids for CVE-2009-4147
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-4147
- http://www.securityfocus.com/archive/1/508146/100/0/threaded
- http://www.securitytracker.com/id?1023250
- http://www.securityfocus.com/archive/1/508142/100/0/threaded
- http://packetstormsecurity.com/files/152997/FreeBSD-rtld-execl-Privilege-Escalation.html
- http://people.freebsd.org/~cperciva/rtld.patch
-
http://www.securityfocus.com/bid/37154
FreeBSD 'execl()' Local Privilege Escalation VulnerabilityExploit
Products affected by CVE-2009-4147
- cpe:2.3:o:freebsd:freebsd:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:freebsd:freebsd:8.0:*:*:*:*:*:*:*