CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Permissions Privileges and Access Controls
Summary: ** disputed ** ldd in the gnu c library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a trojan horse executable file linked with a modified loader that omits certain ld_trace_loaded_objects checks.  note: the gnu c library vendor states "this is just nonsense. there are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set ld_library_path etc."
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2011-03-30
Last Modified Date: 2012-01-19