Exploitation Summary
EIP tracks 2 public exploits for CVE-2001-0170. PoCs published by krochos, Jared Mauch.
AI-analyzed exploit summary This exploit leverages a glibc vulnerability (CVE-2001-0170) to read arbitrary files (e.g., /etc/shadow) by manipulating the RESOLV_HOST_CONF environment variable. It checks for setuid binaries (ssh or traceroute) and uses ssh to trigger the vulnerability, dumping the file contents to /tmp/.resolv.
Description
glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.
Exploits (2)
This exploit leverages a glibc vulnerability (CVE-2001-0170) to read arbitrary files (e.g., /etc/shadow) by manipulating the RESOLV_HOST_CONF environment variable. It checks for setuid binaries (ssh or traceroute) and uses ssh to trigger the vulnerability, dumping the file contents to /tmp/.resolv.
This exploit leverages a vulnerability in the `resolv+` library (CVE-2001-0170) by setting the `RESOLV_HOST_CONF` environment variable to `/etc/shadow` and triggering a `ping` command. This causes the system to read and potentially expose the contents of `/etc/shadow` due to improper handling of environment variables.