CVE-2004-1453

GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.

Affected Software

Name	Vendor	Start Version	End Version
Glibc	Gnu	2.0 (including)	2.0 (including)
Glibc	Gnu	2.0.1 (including)	2.0.1 (including)
Glibc	Gnu	2.0.2 (including)	2.0.2 (including)
Glibc	Gnu	2.0.3 (including)	2.0.3 (including)
Glibc	Gnu	2.0.4 (including)	2.0.4 (including)
Glibc	Gnu	2.0.5 (including)	2.0.5 (including)
Glibc	Gnu	2.0.6 (including)	2.0.6 (including)
Glibc	Gnu	2.1 (including)	2.1 (including)
Glibc	Gnu	2.1.1 (including)	2.1.1 (including)
Glibc	Gnu	2.1.1.6 (including)	2.1.1.6 (including)
Glibc	Gnu	2.1.2 (including)	2.1.2 (including)
Glibc	Gnu	2.1.3 (including)	2.1.3 (including)
Glibc	Gnu	2.1.3.10 (including)	2.1.3.10 (including)
Glibc	Gnu	2.1.9 (including)	2.1.9 (including)
Glibc	Gnu	2.2 (including)	2.2 (including)
Glibc	Gnu	2.2.1 (including)	2.2.1 (including)
Glibc	Gnu	2.2.2 (including)	2.2.2 (including)
Glibc	Gnu	2.2.3 (including)	2.2.3 (including)
Glibc	Gnu	2.2.4 (including)	2.2.4 (including)
Glibc	Gnu	2.2.5 (including)	2.2.5 (including)
Glibc	Gnu	2.3 (including)	2.3 (including)
Glibc	Gnu	2.3.1 (including)	2.3.1 (including)
Glibc	Gnu	2.3.2 (including)	2.3.2 (including)
Glibc	Gnu	2.3.3 (including)	2.3.3 (including)
Glibc	Gnu	2.3.4 (including)	2.3.4 (including)
Red Hat Enterprise Linux 3	RedHat	glibc-0:2.3.2-95.33	*
Red Hat Enterprise Linux AS (Advanced Server) version 2.1	RedHat		*
Red Hat Enterprise Linux ES version 2.1	RedHat		*
Red Hat Enterprise Linux WS version 2.1	RedHat		*
Red Hat Linux Advanced Workstation 2.1	RedHat		*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2004-1453
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References