{"vulnerability": "CVE-2010-3847", "sightings": [{"uuid": "49277bad-0f6d-4c8f-99b3-7cfd6128d2a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44025", "content": "", "creation_timestamp": "2018-02-12T00:00:00.000000Z"}, {"uuid": "b0fa99a5-e44c-4243-8711-0c54e533caad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44024", "content": "", "creation_timestamp": "2018-02-12T00:00:00.000000Z"}, {"uuid": "e5a94a26-1f15-4d81-a257-71a53c6d8cdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "26fe128a-56e9-407c-88ff-1a995e5d5cd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:50.000000Z"}, {"uuid": "947c7df8-40ba-4069-9dd6-d69c1dde49d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "95fe2352-2167-456f-9ca6-d2f6e8372c2f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_origin_expansion_priv_esc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "f6967905-75b1-49b1-a694-36b8725c03a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-3847", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/15274", "content": "", "creation_timestamp": "2010-10-18T00:00:00.000000Z"}, {"uuid": "ce1954c0-4f29-4717-937a-e51708022d92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-3847", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/15304", "content": "", "creation_timestamp": "2010-10-22T00:00:00.000000Z"}, {"uuid": "76753ae1-4b34-4d4d-91e6-c6d1f84c3e59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_origin_expansion_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Tavis Ormandy\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Linux systems by abusing\\n          a vulnerability in the GNU C Library (glibc) dynamic linker.\\n\\n          glibc `ld.so` versions before 2.11.3, and 2.12.x before 2.12.2 does not\\n          properly restrict use of the `LD_AUDIT` environment variable when loading\\n          setuid executables which allows control over the `$ORIGIN` library search\\n          path resulting in execution of arbitrary shared objects.\\n\\n          This module opens a file descriptor to the specified suid executable via\\n          a hard link, then replaces the hard link with a shared object before\\n          instructing the linker to execute the file descriptor, resulting in\\n          arbitrary code execution.\\n\\n          The specified setuid binary must be readable and located on the same\\n          file system partition as the specified writable directory.\\n\\n          This module has been tested successfully on:\\n\\n          glibc 2.5 on CentOS 5.4 (x86_64);\\n          glibc 2.5 on CentOS 5.5 (x86_64);\\n          glibc 2.12 on Fedora 13 (i386); and\\n          glibc 2.5-49 on RHEL 5.5 (x86_64).\\n\\n          Some versions of `ld.so`, such as the version shipped with Ubuntu 14,\\n          hit a failed assertion in `dl_open_worker` causing exploitation to fail.\", \"disclosure_date\": \"2010-10-18\", \"fullname\": \"exploit/linux/local/glibc_origin_expansion_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"glibc '$ORIGIN' Expansion Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/glibc_origin_expansion_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/glibc_origin_expansion_priv_esc\", \"references\": [\"CVE-2010-3847\", \"BID-44154\", \"EDB-15274\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/257\", \"URL-https://www.ubuntu.com/usn/usn-1009-1\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3847\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3847\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Automatic\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:08.474343Z"}, {"uuid": "ee08c0d3-6c4e-42f3-9443-3899c0b0f18e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3847", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Tavis Ormandy\", \"zx2c4\", \"Marco Ivaldi\", \"Todor Donev\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Linux systems by abusing\\n          a vulnerability in the GNU C Library (glibc) dynamic linker.\\n\\n          glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not\\n          properly restrict use of the LD_AUDIT environment variable when loading\\n          setuid executables. This allows loading arbitrary shared objects from\\n          the trusted library search path with the privileges of the suid user.\\n\\n          This module uses LD_AUDIT to load the libpcprofile.so shared object,\\n          distributed with some versions of glibc, and leverages arbitrary file\\n          creation functionality in the library constructor to write a root-owned\\n          world-writable file to a system trusted search path (usually /lib).\\n          The file is then overwritten with a shared object then loaded with\\n          LD_AUDIT resulting in arbitrary code execution.\\n\\n          This module has been tested successfully on glibc version 2.11.1 on\\n          Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386.\\n\\n          RHEL 5 is reportedly affected, but untested. Some glibc distributions\\n          do not contain the libpcprofile.so library required for successful\\n          exploitation.\", \"disclosure_date\": \"2010-10-18\", \"fullname\": \"exploit/linux/local/glibc_ld_audit_dso_load_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/glibc_ld_audit_dso_load_priv_esc\", \"references\": [\"CVE-2010-3847\", \"CVE-2010-3856\", \"BID-44154\", \"BID-44347\", \"EDB-15274\", \"EDB-15304\", \"EDB-18105\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/257\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/344\", \"URL-https://www.ubuntu.com/usn/usn-1009-1\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3847\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3856\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3847\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3856\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Automatic\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:08.255944Z"}]}