CVE-2009-5064: Medium severity gnu c library vulnerability
DISPUTED ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LDTRACELOADEDOBJECTS checks. NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LDLIBRARYPATH etc."
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5064?
The severity of CVE-2009-5064 is considered to be low due to its local attack vector and the disputed nature of the vulnerability.
How do I fix CVE-2009-5064?
To fix CVE-2009-5064, users should upgrade to a newer version of glibc that does not have this vulnerability.
Who is affected by CVE-2009-5064?
CVE-2009-5064 affects users operating versions of the GNU C Library (glibc) up to and including 2.1.2 and earlier.
What are the implications of CVE-2009-5064?
The implications of CVE-2009-5064 could allow local users to gain elevated privileges through cleverly crafted executable files.
Is CVE-2009-5064 a valid vulnerability?
CVE-2009-5064 has been disputed by the GNU C Library vendor, who asserts that the claims are unfounded.