CVE-2006-6164: High severity OpenBSD OpenBSD vulnerability
Published Nov 29, 2006
·Updated
The dlunsetenv function in loader.c in the ELF ld.so in OpenBSD 3.9 and 4.0 does not properly remove duplicate environment variables, which allows local users to pass dangerous variables such as LDPRELOAD to loading processes, which might be leveraged to gain privileges.
Affected Software
2 affected components
OpenBSD OpenBSD=3.9
OpenBSD OpenBSD=4.0
Remediation
Patch Available
Patch Available
Patch Available
Event History
Nov 29, 2006
CVE Published
01:28 AM
Data Sourced
via NVD·01:28 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-6164?
CVE-2006-6164 is considered a local privilege escalation vulnerability.
2
How do I fix CVE-2006-6164?
To fix CVE-2006-6164, upgrade to a patched version of OpenBSD that addresses this issue.
3
What versions of OpenBSD are affected by CVE-2006-6164?
CVE-2006-6164 affects OpenBSD versions 3.9 and 4.0.
4
Who can exploit CVE-2006-6164?
Local users with access to the system can exploit CVE-2006-6164.
5
What is the impact of exploiting CVE-2006-6164?
Exploiting CVE-2006-6164 may allow an attacker to run arbitrary code with elevated privileges.