CVE-2000-0824

The unsetenv function in glibc 2.1.1 does not properly unset an environmental variable if the variable is provided twice to a program, which could allow local users to execute arbitrary commands in setuid programs by specifying their own duplicate environmental variables such as LD_PRELOAD or LD_LIBRARY_PATH.

CVSS v2.0

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

1.23% chance of exploitation in the next 30 days, 67th percentile

Published

2001-01-22

Updated

2024-08-08

Proof-of-concept exploits (1)

• http://www.debian.org/security/2000/20000902

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/19503

References

• CVE Record
• NVD entry

Related

• CVE-2000-0816
• CVE-2000-0828
• CVE-2000-0799
• CVE-2000-0829
• CVE-2000-0798
• CVE-2000-0830