{"vulnerability": "CVE-2010-3856", "sightings": [{"uuid": "6ebca595-c8c8-4be2-8b59-d96ae04ce16c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3856", "type": "exploited", "source": "https://www.exploit-db.com/exploits/44025", "content": "", "creation_timestamp": "2018-02-12T00:00:00.000000Z"}, {"uuid": "7310cb84-af38-4a36-aa43-928fba7b4106", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3856", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "c21e146a-c1d9-4eaa-b28a-f3cb61322ad1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3856", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:08:50.000000Z"}, {"uuid": "679f3b45-d9df-474f-a37e-cd6204963742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3856", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "f6ae309a-340d-4082-b66b-3cbbed351029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-3856", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/15304", "content": "", "creation_timestamp": "2010-10-22T00:00:00.000000Z"}, {"uuid": "ac6a4f5b-721d-4046-b4c3-30ea1db366e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "db99543d-496c-4eef-ad0a-2df2093364df", "vulnerability": "CVE-2010-3856", "type": "confirmed", "source": "https://www.exploit-db.com/exploits/18105", "content": "", "creation_timestamp": "2011-11-10T00:00:00.000000Z"}, {"uuid": "db013f8a-2322-4b2b-9744-ba9f629fc765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-3856", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"Tavis Ormandy\", \"zx2c4\", \"Marco Ivaldi\", \"Todor Donev\", \"bcoles \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module attempts to gain root privileges on Linux systems by abusing\\n          a vulnerability in the GNU C Library (glibc) dynamic linker.\\n\\n          glibc ld.so in versions before 2.11.3, and 2.12.x before 2.12.2 does not\\n          properly restrict use of the LD_AUDIT environment variable when loading\\n          setuid executables. This allows loading arbitrary shared objects from\\n          the trusted library search path with the privileges of the suid user.\\n\\n          This module uses LD_AUDIT to load the libpcprofile.so shared object,\\n          distributed with some versions of glibc, and leverages arbitrary file\\n          creation functionality in the library constructor to write a root-owned\\n          world-writable file to a system trusted search path (usually /lib).\\n          The file is then overwritten with a shared object then loaded with\\n          LD_AUDIT resulting in arbitrary code execution.\\n\\n          This module has been tested successfully on glibc version 2.11.1 on\\n          Ubuntu 10.04 x86_64 and version 2.7 on Debian 5.0.4 i386.\\n\\n          RHEL 5 is reportedly affected, but untested. Some glibc distributions\\n          do not contain the libpcprofile.so library required for successful\\n          exploitation.\", \"disclosure_date\": \"2010-10-18\", \"fullname\": \"exploit/linux/local/glibc_ld_audit_dso_load_priv_esc\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:57:34 +0000\", \"name\": \"glibc LD_AUDIT Arbitrary DSO Load Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/local/glibc_ld_audit_dso_load_priv_esc.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/local/glibc_ld_audit_dso_load_priv_esc\", \"references\": [\"CVE-2010-3847\", \"CVE-2010-3856\", \"BID-44154\", \"BID-44347\", \"EDB-15274\", \"EDB-15304\", \"EDB-18105\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/257\", \"URL-https://seclists.org/fulldisclosure/2010/Oct/344\", \"URL-https://www.ubuntu.com/usn/usn-1009-1\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3847\", \"URL-https://security-tracker.debian.org/tracker/CVE-2010-3856\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3847\", \"URL-https://access.redhat.com/security/cve/CVE-2010-3856\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Automatic\", \"Linux x86\", \"Linux x64\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:08.375877Z"}]}