NetSight
IP …
low2.1Public exploit code

CVE-2001-0170

glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid program…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.

Affected products

VendorProductAffected versions
ImmunixImmunix
Version 7.0_beta
ConectivaLinux
Versions 4.0, 4.0es, 4.1, 4.2, 5.0, 5.1
DebianDebian Linux
Version 2.3
RedhatLinux
Version 7.0

References