full-disclosure

Open Source and information security mailing list archives

Message-ID: <55EB1D0B.7030706@upv.es>
Date: Sat, 5 Sep 2015 18:49:15 +0200
From: Hector Marco-Gisbert <hecmargi@....es>
To: fulldisclosure@...lists.org, bugs@...uritytracker.com,
 bugtraq@...urityfocus.com
Subject: [FD] Glibc Pointer guarding weakness

Hello,

A weakness in the dynamic loader have been found, Glibc prior to 2.22.90 
are affected. The issue is that the LD_POINTER_GUARD in the environment 
is not sanitized allowing local attackers easily to bypass the pointer 
guarding protection on set-user-ID and set-group-ID programs.

Details and PoC at:
http://hmarco.org/bugs/glibc_ptr_mangle_weakness.html

A patch is already sent to Glibc maintainers. This issue is similar to 
http://hmarco.org/bugs/CVE-2013-4788.html but now affect to dynamic 
linked applications.

-- 
Hector Marco-Gisbert @ http://hmarco.org/
Cyber Security Researcher @ http://cybersecurity.upv.es
Universitat Politècnica de València (Spain)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives