CVE-2003-0609
Solaris 2.6-9 - Local Privilege Escalation via LD_PRELOAD Environment Variable
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2003-0609. PoCs published by Marco Ivaldi, osker178.
AI-analyzed exploit summary This exploit leverages a stack-based buffer overflow in Solaris' ld.so.1 via a long LD_PRELOAD environment variable to achieve local privilege escalation. It uses a ret-into-ld.so technique to bypass non-executable stack protections and executes shellcode to spawn a root shell.
Description
Stack-based buffer overflow in the runtime linker, ld.so.1, on Solaris 2.6 through 9 allows local users to gain root privileges via a long LD_PRELOAD environment variable.
Exploits (2)
This exploit leverages a stack-based buffer overflow in Solaris' ld.so.1 via a long LD_PRELOAD environment variable to achieve local privilege escalation. It uses a ret-into-ld.so technique to bypass non-executable stack protections and executes shellcode to spawn a root shell.
This exploit targets a buffer overflow in the Solaris runtime linker (ld.so.1) on SPARC architecture, leveraging the LD_PRELOAD environment variable to execute arbitrary shellcode. The shellcode performs privilege escalation by calling setuid(0) and setreuid(0) before spawning a shell.