CVE-2010-3369 The (1) mdb and (2) mdb-symbolreader scripts in mono-debugger 2.4.3, and other versions before 2.8.1, place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privil...
MediumCVSS 6.9
EPSS 0.39%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) mdb and (2) mdb-symbolreader scripts in mono-debugger 2.4.3, and other versions before 2.8.1, place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian mono-debugger | = 2.4.3 | No fix listed |
| debian mono-debugger | = 2.6 | No fix listed |
| debian mono-debugger | = 2.6.1 | No fix listed |
| debian mono-debugger | = 2.6.3 | No fix listed |
| debian mono-debugger | = 2.6.4 | No fix listed |
| debian mono-debugger | = 2.6.7 | No fix listed |
| debian mono-debugger | = 2.8 | No fix listed |
References
- bugs.debian.org exploit patch
- 42348 third-party-advisory vendor-advisory
- www.mono-project.com
- bugzilla.novell.com