Published: 14/04/2005 Updated: 11/10/2017

CVSS v2 Base Score: 6.2 | Impact Score: 10 | Exploitability Score: 1.9

VMScore: 635

Vector: AV:L/AC:H/Au:N/C:C/I:C/A:C

Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 up to and including 2.429-rc2 and 2.6 up to and including 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.

Vulnerable Product	Search on Vulmon	Subscribe to Product
avaya network routing
avaya converged communications server 2.0
linux linux kernel 2.4.0
linux linux kernel 2.4.15
linux linux kernel 2.4.16
linux linux kernel 2.4.18
linux linux kernel 2.4.19
linux linux kernel 2.4.21
linux linux kernel 2.4.22
linux linux kernel 2.4.26
linux linux kernel 2.4.27
linux linux kernel 2.4.3
linux linux kernel 2.4.4
linux linux kernel 2.6.0
avaya mn100
linux linux kernel 2.6.3
linux linux kernel 2.6.4
linux linux kernel 2.6.8
mandrakesoft mandrake linux 10.1
mandrakesoft mandrake linux 9.2
redhat enterprise linux 4.0
redhat linux 7.3
redhat linux 9.0
suse suse linux 9.1
suse suse linux 9.2
ubuntu ubuntu linux 4.1
linux linux kernel 2.4.13
linux linux kernel 2.4.14
linux linux kernel 2.4.24_ow1
linux linux kernel 2.4.25
linux linux kernel 2.4.28
linux linux kernel 2.4.29
linux linux kernel 2.4.9
linux linux kernel 2.6.10
linux linux kernel 2.6.2
linux linux kernel 2.6.7
mandrakesoft mandrake linux 10.0
redhat enterprise linux 3.0
redhat fedora core core_2.0
redhat fedora core core_3.0
suse suse linux 9.0
avaya modular messaging message storage server 1.1
avaya modular messaging message storage server 2.0
linux linux kernel 2.4.11
linux linux kernel 2.4.12
linux linux kernel 2.4.20
linux linux kernel 2.4.23_ow2
linux linux kernel 2.4.24
linux linux kernel 2.4.7
linux linux kernel 2.4.8
linux linux kernel 2.6.1
linux linux kernel 2.6.6
linux linux kernel 2.6_test9_cvs
mandrakesoft mandrake linux corporate server 3.0
redhat enterprise linux desktop 4.0
redhat fedora core core_1.0
suse suse linux 8.2
suse suse linux 8
avaya s8710 r2.0.0
avaya s8710 r2.0.1
linux linux kernel 2.4.1
linux linux kernel 2.4.10
linux linux kernel 2.4.17
linux linux kernel 2.4.2
linux linux kernel 2.4.23
linux linux kernel 2.4.5
linux linux kernel 2.4.6
linux linux kernel 2.6.5
linux linux kernel 2.6.9
mandrakesoft mandrake linux corporate server 2.1
redhat enterprise linux desktop 3.0
suse suse linux 1.0
suse suse linux 8.1
avaya s8500 r2.0.0
avaya s8500 r2.0.1
avaya s8300 r2.0.0
avaya s8300 r2.0.1
avaya intuity audix
mandrakesoft mandrake multi network firewall 8.2
conectiva linux 10.0
avaya s8700 r2.0.0
avaya s8700 r2.0.1

Paul Starzetz discovered a race condition in the ELF library and aout binary format loaders, which can be locally exploited in several different ways to gain root privileges (CAN-2004-1235) ...

Synopsis kernel security update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix several security issues in Red HatEnterprise Linux 21 are now available Description The Linux kernel handles the basic functions of the operating systemThis advisory includes ...

Synopsis kernel security update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix several security issues in Red HatEnterprise Linux 3 are now available Description The Linux kernel handles the basic functions of the operating systemThis advisory includes f ...

Synopsis kernel security update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4This update has been rated as having important security impact by the RedHat Security Response Team Description ...

Several local and remote vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or the execution of arbitrary code The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2004-0427 A local denial of service vulnerability in do_fork() has been found CVE-2005-0489 A ...

/* * EDB Note: There's is an updated version ~ wwwexploit-dbcom/exploits/895/ */ /* * Linux kernel 24 uselib() privilege elevation exploit * * original exploit source from isecpl * reference: isecpl/vulnerabilities/isec-0021-uselibtxt * * I modified the Paul Starzetz's exploit, made it more possible * to race ...

/* * EDB Note: There's is an updated version ~ wwwexploit-dbcom/exploits/895/ */ /* * binfmt_elf uselib VMA insert race vulnerability * v108 * * gcc -O2 -fomit-frame-pointer elflblc -o elflbl * * Copyright (c) 2004 iSEC Security Research All Rights Reserved * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDE ...

/* * pwnedc - linux 24 and 26 sys_uselib local root exploit PRIVATE * it's not the best one, the ldt approach is definitively better * discovered may 2004 no longer private because lorian/cliph/ihaquer * can lick my balls * (c) 2004 sd <sd@fucksheeporg> * requieres cca 1gb on fs */ /* * first create fake vma structs * * * let's h ...

NVD-CWE-Other http://www.redhat.com/support/errata/RHSA-2005-043.html http://www.securityfocus.com/bid/12190 http://isec.pl/vulnerabilities/isec-0021-uselib.txt http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000930 http://www.securityfocus.com/advisories/7806 http://www.securityfocus.com/advisories/7805 https://bugzilla.fedora.us/show_bug.cgi?id=2336 http://www.redhat.com/support/errata/RHSA-2005-092.html http://www.trustix.org/errata/2005/0001/http://www.securityfocus.com/advisories/7804 http://www.redhat.com/support/errata/RHSA-2005-016.html http://www.redhat.com/support/errata/RHSA-2005-017.html http://secunia.com/advisories/20162 http://secunia.com/advisories/20163 http://secunia.com/advisories/20202 http://secunia.com/advisories/20338 http://www.novell.com/linux/security/advisories/2005_01_sr.html http://www.mandriva.com/security/advisories?name=MDKSA-2005:022 http://www.debian.org/security/2006/dsa-1067 http://www.debian.org/security/2006/dsa-1070 http://www.debian.org/security/2006/dsa-1082 http://www.debian.org/security/2006/dsa-1069 http://marc.info/?l=bugtraq&m=110512575901427&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/18800 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9567 https://usn.ubuntu.com/57-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/778/

CVE-2004-1235

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect