TELNET Exploit: LD_LIBRARY_PATH

This signature detects attempts to exploit a known vulnerability in TELNET that allows remote clients to specify environment variables. Attackers can place a shared object library containing executable code on the system, set this library as a LD_LIBRARY_PATH environment variable, and open a TELNET connection with the target host. When TELNET executes the /bin/login during user authentication, the dynamic linker loads the library listed in the LD_LIBRARY_PATH, thus bypassing normal system libraries and allowing the attacker to execute code as root.

Extended Description

A vulnerability existed in a number of in.telnetd's, that when coupled with dynamic linking introduced a very serious vulnerability. Telnet supports the passing of environment variables from a remote host. On vulnerable systems, an attacker would place a shared object containing code they are sure will be run, for instance, the crypt() function on the system. This could be via ftp, nfs, or any other method for getting a file on the system. They would then set this library to be part of their LD_PRELOAD enviroment variable. Upon telneting into the machine, when telnet exec'd /bin/login to authenticate the user, the system dynamic linker would load the library listed in the preload, which would override the normal library call. This in turn could allow a user to execute code as root.

Affected Products

Digital unix

References

BugTraq: 459

CVE: CVE-1999-0073

URL: http://www.cert.org/advisories/CA-1995-14.html

Short Name

TELNET:EXPLOIT:LD-LIBRARY-PATH

Severity

Critical

Recommended

False

Recommended Action

Drop

TELNET Exploit: LD_LIBRARY_PATH

Extended Description

Affected Products

References

Found a potential security threat?