CVE-2009-4147: High severity freebsd kernel vulnerability
The rtld function in the Run-Time Link-Editor (rtld) in libexec/rtld-elf/rtld.c in FreeBSD 7.1 and 8.0 does not clear the (1) LDLIBMAP, (2) LDLIBRARYPATH, (3) LDLIBMAPDISABLE, (4) LDDEBUG, and (5) LDELFHINTSPATH environment variables, which allows local users to gain privileges by executing a setuid or setguid program with a modified variable containing an untrusted search path that points to a Trojan horse library, different vectors than CVE-2009-4146.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-4147?
CVE-2009-4147 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2009-4147?
To mitigate CVE-2009-4147, you should upgrade to a patched version of FreeBSD beyond 8.0.
Who is affected by CVE-2009-4147?
CVE-2009-4147 affects users of FreeBSD versions 7.1 and 8.0.
What could happen if CVE-2009-4147 is exploited?
Exploitation of CVE-2009-4147 could allow local users to gain elevated privileges.
Is CVE-2009-4147 still a threat today?
While CVE-2009-4147 is a historical vulnerability, it remains a concern for systems still using affected FreeBSD versions.