ID CVE-2011-1095
Summary locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
References
Vulnerable Configurations
  • GNU glibc 1.00
    cpe:2.3:a:gnu:glibc:1.00
  • GNU glibc 1.01
    cpe:2.3:a:gnu:glibc:1.01
  • GNU glibc 1.02
    cpe:2.3:a:gnu:glibc:1.02
  • GNU glibc 1.03
    cpe:2.3:a:gnu:glibc:1.03
  • GNU glibc 1.04
    cpe:2.3:a:gnu:glibc:1.04
  • GNU glibc 1.05
    cpe:2.3:a:gnu:glibc:1.05
  • GNU glibc 1.06
    cpe:2.3:a:gnu:glibc:1.06
  • GNU glibc 1.07
    cpe:2.3:a:gnu:glibc:1.07
  • GNU glibc 1.08
    cpe:2.3:a:gnu:glibc:1.08
  • GNU glibc 1.09
    cpe:2.3:a:gnu:glibc:1.09
  • GNU glibc 1.09.1
    cpe:2.3:a:gnu:glibc:1.09.1
  • GNU glibc 2.0
    cpe:2.3:a:gnu:glibc:2.0
  • GNU glibc 2.0.1
    cpe:2.3:a:gnu:glibc:2.0.1
  • GNU glibc 2.0.2
    cpe:2.3:a:gnu:glibc:2.0.2
  • GNU glibc 2.0.3
    cpe:2.3:a:gnu:glibc:2.0.3
  • GNU glibc 2.0.4
    cpe:2.3:a:gnu:glibc:2.0.4
  • GNU glibc 2.0.5
    cpe:2.3:a:gnu:glibc:2.0.5
  • GNU glibc 2.0.6
    cpe:2.3:a:gnu:glibc:2.0.6
  • GNU glibc 2.1
    cpe:2.3:a:gnu:glibc:2.1
  • GNU glibc 2.1.1
    cpe:2.3:a:gnu:glibc:2.1.1
  • GNU glibc 2.1.1.6
    cpe:2.3:a:gnu:glibc:2.1.1.6
  • GNU glibc 2.1.2
    cpe:2.3:a:gnu:glibc:2.1.2
  • GNU glibc 2.1.3
    cpe:2.3:a:gnu:glibc:2.1.3
  • GNU glibc 2.1.3.10
    cpe:2.3:a:gnu:glibc:2.1.3.10
  • GNU glibc 2.1.9
    cpe:2.3:a:gnu:glibc:2.1.9
  • GNU glibc 2.2
    cpe:2.3:a:gnu:glibc:2.2
  • GNU glibc 2.2.1
    cpe:2.3:a:gnu:glibc:2.2.1
  • GNU glibc 2.2.2
    cpe:2.3:a:gnu:glibc:2.2.2
  • GNU glibc 2.2.3
    cpe:2.3:a:gnu:glibc:2.2.3
  • GNU glibc 2.2.4
    cpe:2.3:a:gnu:glibc:2.2.4
  • GNU glibc 2.2.5
    cpe:2.3:a:gnu:glibc:2.2.5
  • GNU glibc 2.3
    cpe:2.3:a:gnu:glibc:2.3
  • GNU glibc 2.3.1
    cpe:2.3:a:gnu:glibc:2.3.1
  • GNU glibc 2.3.2
    cpe:2.3:a:gnu:glibc:2.3.2
  • GNU glibc 2.3.3
    cpe:2.3:a:gnu:glibc:2.3.3
  • GNU glibc 2.3.4
    cpe:2.3:a:gnu:glibc:2.3.4
  • GNU glibc 2.3.5
    cpe:2.3:a:gnu:glibc:2.3.5
  • GNU glibc 2.3.6
    cpe:2.3:a:gnu:glibc:2.3.6
  • GNU glibc 2.3.10
    cpe:2.3:a:gnu:glibc:2.3.10
  • GNU glibc 2.4
    cpe:2.3:a:gnu:glibc:2.4
  • GNU glibc 2.5
    cpe:2.3:a:gnu:glibc:2.5
  • GNU glibc 2.5.1
    cpe:2.3:a:gnu:glibc:2.5.1
  • GNU glibc 2.6
    cpe:2.3:a:gnu:glibc:2.6
  • GNU glibc 2.6.1
    cpe:2.3:a:gnu:glibc:2.6.1
  • GNU glibc 2.7
    cpe:2.3:a:gnu:glibc:2.7
  • GNU glibc 2.8
    cpe:2.3:a:gnu:glibc:2.8
  • GNU glibc 2.9
    cpe:2.3:a:gnu:glibc:2.9
  • GNU glibc 2.10
    cpe:2.3:a:gnu:glibc:2.10
  • GNU glibc 2.10.1
    cpe:2.3:a:gnu:glibc:2.10.1
  • GNU glibc 2.10.2
    cpe:2.3:a:gnu:glibc:2.10.2
  • GNU glibc 2.11
    cpe:2.3:a:gnu:glibc:2.11
  • GNU glibc 2.11.1
    cpe:2.3:a:gnu:glibc:2.11.1
  • GNU glibc 2.11.2
    cpe:2.3:a:gnu:glibc:2.11.2
  • GNU glibc 2.11.3
    cpe:2.3:a:gnu:glibc:2.11.3
  • GNU glibc 2.12.0
    cpe:2.3:a:gnu:glibc:2.12.0
  • GNU glibc 2.12.1
    cpe:2.3:a:gnu:glibc:2.12.1
  • GNU glibc 2.12.2
    cpe:2.3:a:gnu:glibc:2.12.2
CVSS
Base: 6.2 (as of 11-04-2011 - 12:20)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2015-0023.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Switch to use malloc when the input line is too long [Orabug 19951108] - Use a /sys/devices/system/cpu/online for _SC_NPROCESSORS_ONLN implementation [Orabug 17642251] (Joe Jin) - Fix parsing of numeric hosts in gethostbyname_r (CVE-2015-0235, #1183532). - Remove gconv transliteration loadable modules support (CVE-2014-5119, - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475, - Fix patch for integer overflows in *valloc and memalign. (CVE-2013-4332, #1011805). - Fix return code when starting an already started nscd daemon (#979413). - Fix getnameinfo for many PTR record queries (#1020486). - Return EINVAL error for negative sizees to getgroups (#995207). - Fix integer overflows in *valloc and memalign. (CVE-2013-4332, #1011805). - Add support for newer L3 caches on x86-64 and correctly count the number of hardware threads sharing a cacheline (#1003420). - Revert incomplete fix for bug #758193. - Fix _nl_find_msg malloc failure case, and callers (#957089). - Test on init_fct, not result->__init_fct, after demangling (#816647). - Don't handle ttl == 0 specially (#929035). - Fix multibyte character processing crash in regexp (CVE-2013-0242, #951132) - Fix getaddrinfo stack overflow resulting in application crash (CVE-2013-1914, #951132) - Add missing patch to avoid use after free (#816647) - Fix race in initgroups compat_call (#706571) - Fix return value from getaddrinfo when servers are down. (#758193) - Fix fseek on wide character streams. Sync's seeking code with RHEL 6 (#835828) - Call feraiseexcept only if exceptions are not masked (#861871). - Always demangle function before checking for NULL value. (#816647). - Do not fail in ttyname if /proc is not available (#851450). - Fix errno for various overflow situations in vfprintf. Add missing overflow checks. (#857387) - Handle failure of _nl_explode_name in all cases (#848481) - Define the default fuzz factor to 2 to make it easier to manipulate RHEL 5 RPMs on RHEL 6 and newer systems. - Fix race in intl/* testsuite (#849202) - Fix out of bounds array access in strto* exposed by 847930 patch. - Really fix POWER4 strncmp crash (#766832). - Fix integer overflow leading to buffer overflow in strto* (#847930) - Fix race in msort/qsort (#843672) - Fix regression due to 797096 changes (#845952) - Do not use PT_IEEE_IP ptrace calls (#839572) - Update ULPs (#837852) - Fix various transcendentals in non-default rounding modes (#837852) - Fix unbound alloca in vfprintf (#826947) - Fix iconv segfault if the invalid multibyte character 0xffff is input when converting from IBM930. (#823905) - Fix fnmatch when '*' wildcard is applied on a file name containing multibyte chars. (#819430) - Fix unbound allocas use in glob_in_dir, getaddrinfo and others. (#797096) - Fix segfault when running ld.so --verify on some DSO's in current working directory. (#808342) - Incorrect initialization order for dynamic loader (#813348) - Fix return code when stopping already stopped nscd daemon (#678227) - Remove MAP_32BIT for pthread stack mappings, use MAP_STACK instead (#641094) - Fix setuid vs sighandler_setxid race (#769852) - Fix access after end of search string in regex matcher (#757887) - Fix POWER4 strncmp crash (#766832) - Fix SC_*CACHE detection for X5670 cpus (#692182) - Fix parsing IPV6 entries in /etc/resolv.conf (#703239) - Fix double-free in nss_nis code (#500767) - Add kernel VDSO support for s390x (#795896) - Fix race in malloc arena creation and make implementation match documented behaviour (#800240) - Do not override TTL of CNAME with TTL of its alias (#808014) - Fix short month names in fi_FI locale #(657266). - Fix nscd crash for group with large number of members (#788989) - Fix Slovakia currency (#799853) - Fix getent malloc failure check (#806403) - Fix short month names in zh_CN locale (#657588) - Fix decimal point symbol for Portuguese currency (#710216) - Avoid integer overflow in sbrk (#767358) - Avoid race between [,__de]allocate_stack and __reclaim_stacks during fork (#738665) - Fix race between IO_flush_all_lockp & pthread_cancel (#751748) - Fix memory leak in NIS endgrent (#809325) - Allow getaddr to accept SCTP socket types in hints (#765710) - Fix errno handling in vfprintf (#794814) - Filter out when building file lists (#784646). - Avoid 'nargs' integer overflow which could be used to bypass FORTIFY_SOURCE (#794814) - Fix currency_symbol for uk_UA (#639000) - Correct test for detecting cycle during topo sort (#729661) - Check values from TZ file header (#767688) - Complete the numeric settings fix (#675259) - Complete the change for error codes from pthread_create (#707998) - Truncate time values in Linux futimes when falling back to utime (#758252) - Update systemtaparches - Add rules to build libresolv with SSP flags (#756453) - Fix PLT reference - Workaround misconfigured system (#702300) - Update systemtaparches - Correct cycle detection during dependency sorting (#729661) - Add gdb hooks (#711924) - Fix alloca accounting in strxfm and strcoll (#585433) - Correct cycle detection during dependency sorting (#729661) - ldd: never run file directly (#531160) - Implement greedy matching of weekday and month names (#657570) - Fix incorrect numeric settings (#675259) - Implement new mode for NIS passwd.adjunct.byname table (#678318) - Query NIS domain only when needed (#703345) - Count total processors using sysfs (#706894) - Translate clone error if necessary (#707998) - Workaround kernel clobbering robust list (#711531) - Use correct type when casting d_tag (#599056, CVE-2010-0830) - Report write error in addmnt even for cached streams (#688980, CVE-2011-1089) - Don't underestimate length of DST substitution (#694655) - Don't allocate executable stack when it cannot be allocated in the first 4G (#448011) - Initialize resolver state in nscd (#676039) - No cancel signal in unsafe places (#684808) - Check size of pattern in wide character representation in fnmatch (#681054) - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071) - Properly quote output of locale (#625893, CVE-2011-1095) - Don't leave empty element in rpath when skipping the first element, ignore rpath elements containing non-isolated use of $ORIGIN when privileged (#667974, CVE-2011-0536) - Fix handling of newline in addmntent (#559579, CVE-2010-0296) - Don't ignore $ORIGIN in libraries (#670988) - Fix false assertion (#604796) - Fix ordering of DSO constructors and destructors (#604796) - Fix typo (#531576) - Fix concurrency problem between dl_open and dl_iterate_phdr (#649956) - Require suid bit on audit objects in privileged programs (#645678, CVE-2010-3856) - Never expand $ORIGIN in privileged programs (#643819, CVE-2010-3847) - Add timestamps to nscd logs (#527558) - Fix index wraparound handling in memusage (#531576) - Handle running out of buffer space with IPv6 mapping enabled (#533367) - Don't deadlock in __dl_iterate_phdr while (un)loading objects (#549813) - Avoid alloca in setenv for long strings (#559974) - Recognize POWER7 and ISA 2.06 (#563563) - Add support for AT_BASE_PLATFORM (#563599) - Restore locking in free_check (#585674) - Fix lookup of collation sequence value during regexp matching (#587360) - Fix POWER6 memcpy/memset (#579011) - Fix scope handling during dl_close (#593675) - Enable -fasynchronous-unwind-tables throughout (#593047) - Fix crash when aio thread creation fails (#566712)
    last seen 2019-02-21
    modified 2018-07-24
    plugin id 81118
    published 2015-02-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81118
    title OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2012-0125.NASL
    description Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029) A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064) It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash. (CVE-2011-1659) A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609) Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830. This update also fixes the following bug : * When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009) Users should upgrade to these updated packages, which resolve these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 57923
    published 2012-02-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57923
    title CentOS 4 : glibc (CESA-2012:0125)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-0412.NASL
    description Updated glibc packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc addmntent() function did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into /etc/mtab via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 53291
    published 2011-04-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53291
    title RHEL 5 : glibc (RHSA-2011:0412)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_GLIBC-110516.NASL
    description This update fixes the following security issues found in glibc : - Specially crafted input to the fnmatch function could cause an integer overflow. (CVE-2011-1071) - The output of the 'locale' command was not properly quoted. (CVE-2011-1095) - Unprivileged users could read the NIS shadow database. (CVE-2010-0015) - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setuid binaries. (CVE-2011-0536) The update also includes fixes for non-security bugs. Please refer to the package changelog for details.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 55441
    published 2011-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55441
    title SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20110404_GLIBC_ON_SL5_X.NASL
    description The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61008
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61008
    title Scientific Linux Security Update : glibc on SL5.x,SL6.x i386/x86_64
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0012_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries : - Kernel - krb5 - glibc - mtp2sas - mptsas - mptspi
    last seen 2019-02-21
    modified 2018-08-16
    plugin id 89680
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89680
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2011-0413.NASL
    description From Red Hat Security Advisory 2011:0413 : Updated glibc packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68245
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68245
    title Oracle Linux 6 : glibc (ELSA-2011-0413)
  • NASL family SuSE Local Security Checks
    NASL id SUSE9_12775.NASL
    description This update contains the following fixes : - Specially crafted input to the fnmatch function could cause an integer overflow. (CVE-2011-1071) - The output of the 'locale' command was not properly quoted. (CVE-2011-1095) - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setuid binaries. (CVE-2011-0536)
    last seen 2019-02-21
    modified 2012-04-23
    plugin id 55440
    published 2011-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55440
    title SuSE9 Security Update : glibc (YOU Patch Number 12775)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0010.NASL
    description a. Service Console update for DHCP The DHCP client daemon, dhclient, does not properly sanatize certain options in DHCP server replies. An attacker could send a specially crafted DHCP server reply, that is saved on the client system and evaluated by a process that assumes the option is trusted. This could lead to arbitrary code execution with the privileges of the evaluating process. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2011-0997 to this issue. b. Service Console update for glibc This patch updates the glibc package for ESX service console to glibc-2.5-58.7602.vmw. This fixes multiple security issues in glibc, glibc-common and nscd including possible local privilege escalation. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2010-0296, CVE-2011-0536, CVE-2011-1095, CVE-2011-1071, CVE-2011-1658 and CVE-2011-1659 to these issues.
    last seen 2019-02-21
    modified 2018-09-06
    plugin id 55747
    published 2011-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55747
    title VMSA-2011-0010 : VMware ESX third-party updates for Service Console packages glibc and dhcp
  • NASL family Misc.
    NASL id VMWARE_ESXI_5_0_BUILD_515841_REMOTE.NASL
    description The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities : - A security bypass vulnerability exists in the e1000 driver in the Linux kernel due to improper handling of Ethernet frames that exceed the MTU. An unauthenticated, remote attacker can exploit this, via trailing payload data, to bypass packet filters. (CVE-2009-4536) - An error exists in the file misc/mntent_r.c that could allow a local attacker to cause denial of service conditions. (CVE-2010-0296) - An error exists related to glibc, the dynamic linker and '$ORIGIN' substitution that could allow privilege escalation. (CVE-2011-0536) - An error exists in the function 'fnmatch' in the file posix/fnmatch.c that could allow arbitrary code execution. (CVE-2011-1071) - An error exists in the file locale/programs/locale.c related to localization environment variables that could allow privilege escalation. (CVE-2011-1095) - An error exists related to glibc, the dynamic linker and 'RPATH' that could allow privilege escalation. (CVE-2011-1658) - An error exists in the function 'fnmatch' related to UTF-8 string handling that could allow privilege escalation. (CVE-2011-1659)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 70880
    published 2013-11-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70880
    title ESXi 5.0 < Build 515841 Multiple Vulnerabilities (remote check)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2011-0412.NASL
    description Updated glibc packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc addmntent() function did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into /etc/mtab via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 53430
    published 2011-04-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53430
    title CentOS 5 : glibc (CESA-2011:0412)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2012-0125.NASL
    description Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029) A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064) It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash. (CVE-2011-1659) A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609) Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830. This update also fixes the following bug : * When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009) Users should upgrade to these updated packages, which resolve these issues.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 57928
    published 2012-02-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57928
    title RHEL 4 : glibc (RHSA-2012:0125)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1396-1.NASL
    description It was discovered that the GNU C Library did not properly handle integer overflows in the timezone handling code. An attacker could use this to possibly execute arbitrary code by convincing an application to load a maliciously constructed tzfile. (CVE-2009-5029) It was discovered that the GNU C Library did not properly handle passwd.adjunct.byname map entries in the Network Information Service (NIS) code in the name service caching daemon (nscd). An attacker could use this to obtain the encrypted passwords of NIS accounts. This issue only affected Ubuntu 8.04 LTS. (CVE-2010-0015) Chris Evans reported that the GNU C Library did not properly calculate the amount of memory to allocate in the fnmatch() code. An attacker could use this to cause a denial of service or possibly execute arbitrary code via a maliciously crafted UTF-8 string. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 10.10. (CVE-2011-1071) Tomas Hoger reported that an additional integer overflow was possible in the GNU C Library fnmatch() code. An attacker could use this to cause a denial of service via a maliciously crafted UTF-8 string. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1659) Dan Rosenberg discovered that the addmntent() function in the GNU C Library did not report an error status for failed attempts to write to the /etc/mtab file. This could allow an attacker to corrupt /etc/mtab, possibly causing a denial of service or otherwise manipulate mount options. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1089) Harald van Dijk discovered that the locale program included with the GNU C library did not properly quote its output. This could allow a local attacker to possibly execute arbitrary code using a crafted localization string that was evaluated in a shell script. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 10.10. (CVE-2011-1095) It was discovered that the GNU C library loader expanded the $ORIGIN dynamic string token when RPATH is composed entirely of this token. This could allow an attacker to gain privilege via a setuid program that had this RPATH value. (CVE-2011-1658) It was discovered that the GNU C library implementation of memcpy optimized for Supplemental Streaming SIMD Extensions 3 (SSSE3) contained a possible integer overflow. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS. (CVE-2011-2702) John Zimmerman discovered that the Remote Procedure Call (RPC) implementation in the GNU C Library did not properly handle large numbers of connections. This could allow a remote attacker to cause a denial of service. (CVE-2011-4609) It was discovered that the GNU C Library vfprintf() implementation contained a possible integer overflow in the format string protection code offered by FORTIFY_SOURCE. An attacker could use this flaw in conjunction with a format string vulnerability to bypass the format string protection and possibly execute arbitrary code. (CVE-2012-0864). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 58318
    published 2012-03-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=58318
    title Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : eglibc, glibc vulnerabilities (USN-1396-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201312-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201312-01 (GNU C Library: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in GNU C Library. Please review the CVE identifiers referenced below for details. Impact : A local attacker could trigger vulnerabilities in dynamic library loader, making it possible to load attacker-controlled shared objects during execution of setuid/setgid programs to escalate privileges. A context-dependent attacker could trigger various vulnerabilities in GNU C Library, including a buffer overflow, leading to execution of arbitrary code or a Denial of Service. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 71167
    published 2013-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71167
    title GLSA-201312-01 : GNU C Library: Multiple vulnerabilities
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0010_REMOTE.NASL
    description The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including arbitrary code execution vulnerabilities, in several third-party components and libraries : - DHCP - glibc
    last seen 2019-02-21
    modified 2018-08-16
    plugin id 89679
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89679
    title VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0010) (remote check)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_GLIBC-7574.NASL
    description This update contains the following fixes : - Specially crafted input to the fnmatch function could cause an integer overflow. (CVE-2011-1071) - The output of the 'locale' command was not properly quoted. (CVE-2011-1095) - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setuid binaries. (CVE-2011-0536) - The update also includes fixes for non-security bugs. Please refer to the package changelog for details.
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 57201
    published 2011-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57201
    title SuSE 10 Security Update : glibc (ZYPP Patch Number 7574)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2011-0413.NASL
    description Updated glibc packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 53292
    published 2011-04-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53292
    title RHEL 6 : glibc (RHSA-2011:0413)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20120213_GLIBC_ON_SL4_X.NASL
    description The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029) A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064) It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash. (CVE-2011-1659) A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609) This update also fixes the following bug : - When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. Users should upgrade to these updated packages, which resolve these issues.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 61243
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=61243
    title Scientific Linux Security Update : glibc on SL4.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2012-0125.NASL
    description From Red Hat Security Advisory 2012:0125 : Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029) A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064) It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash. (CVE-2011-1659) A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609) Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830. This update also fixes the following bug : * When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009) Users should upgrade to these updated packages, which resolve these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68455
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68455
    title Oracle Linux 4 : glibc (ELSA-2012-0125)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_GLIBC-110517.NASL
    description This update fixes the following security issues found in glibc : - Specially crafted input to the fnmatch function could cause an integer overflow. (CVE-2011-1071) - The output of the 'locale' command was not properly quoted. (CVE-2011-1095) - Unprivileged users could read the NIS shadow database. (CVE-2010-0015) - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setuid binaries. (CVE-2011-0536) The update also includes fixes for non-security bugs. Please refer to the package changelog for details.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 57106
    published 2011-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57106
    title SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2011-178.NASL
    description Multiple vulnerabilities was discovered and fixed in glibc : Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has in (a) RPATH or (b) RUNPATH. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847 (CVE-2011-0536). The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a stack extension attack, a related issue to CVE-2010-2898, as originally reported for use of this library by Google Chrome (CVE-2011-1071). The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296 (CVE-2011-1089). locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function (CVE-2011-1095). Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071 (CVE-2011-1659). crypt_blowfish before 1.1, as used in glibc on certain platforms, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash (CVE-2011-2483). The updated packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 56953
    published 2011-11-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56953
    title Mandriva Linux Security Advisory : glibc (MDVSA-2011:178)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2011-0412.NASL
    description From Red Hat Security Advisory 2011:0412 : Updated glibc packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536) It was discovered that the glibc addmntent() function did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into /etc/mtab via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296) It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071) It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095) All users should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68244
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68244
    title Oracle Linux 5 : glibc (ELSA-2011-0412)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_GLIBC-7575.NASL
    description The following bugs have been fixed : - Specially crafted input to the fnmatch function could cause an integer overflow. (CVE-2011-1071) - The output of the 'locale' command was not properly quoted. (CVE-2011-1095) - Don't search the current directory if $ORIGIN is in RPATH of libraries called by setuid binaries. (CVE-2011-0536) - The update also includes fixes for non-security bugs. Please refer to the package changelog for details.
    last seen 2019-02-21
    modified 2012-05-17
    plugin id 55442
    published 2011-06-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=55442
    title SuSE 10 Security Update : glibc (ZYPP Patch Number 7575)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0012.NASL
    description a. ESX third-party update for Service Console kernel This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues. b. ESX third-party update for Service Console krb5 RPMs This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1, which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282 to these issues. c. ESXi and ESX update to third-party component glibc The glibc third-party library is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071, CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues. d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas driver. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.
    last seen 2019-02-21
    modified 2018-09-06
    plugin id 56508
    published 2011-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56508
    title VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console
oval via4
accepted 2011-12-05T04:00:03.208-05:00
class vulnerability
contributors
name Aslesha Nargolkar
organization Hewlett-Packard
definition_extensions
comment VMware ESX Server 4.1 is installed
oval oval:org.mitre.oval:def:13012
description locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
family unix
id oval:org.mitre.oval:def:12272
status accepted
submitted 2011-09-06T16:14:19.000-05:00
title VMSA-2011-0010 VMware ESX third party updates for Service Console packages glibc and dhcp
version 6
redhat via4
advisories
  • rhsa
    id RHSA-2011:0412
  • rhsa
    id RHSA-2011:0413
rpms
  • glibc-0:2.5-58.el5_6.2
  • glibc-common-0:2.5-58.el5_6.2
  • glibc-devel-0:2.5-58.el5_6.2
  • glibc-headers-0:2.5-58.el5_6.2
  • glibc-utils-0:2.5-58.el5_6.2
  • nscd-0:2.5-58.el5_6.2
  • glibc-0:2.12-1.7.el6_0.5
  • glibc-common-0:2.12-1.7.el6_0.5
  • glibc-devel-0:2.12-1.7.el6_0.5
  • glibc-headers-0:2.12-1.7.el6_0.5
  • glibc-static-0:2.12-1.7.el6_0.5
  • glibc-utils-0:2.12-1.7.el6_0.5
  • nscd-0:2.12-1.7.el6_0.5
  • glibc-0:2.3.4-2.57
  • glibc-common-0:2.3.4-2.57
  • glibc-devel-0:2.3.4-2.57
  • glibc-headers-0:2.3.4-2.57
  • glibc-profile-0:2.3.4-2.57
  • glibc-utils-0:2.3.4-2.57
  • nptl-devel-0:2.3.4-2.57
  • nscd-0:2.3.4-2.57
refmap via4
bugtraq 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console
confirm
gentoo GLSA-201011-01
mandriva MDVSA-2011:178
mlist
  • [oss-security] 20110308 Re: glibc locale escaping issue
  • [oss-security] 20110308 glibc locale escaping issue
sectrack 1025286
secunia
  • 43830
  • 43976
  • 43989
  • 46397
vupen ADV-2011-0863
Last major update 26-01-2012 - 22:58
Published 09-04-2011 - 22:55
Last modified 09-10-2018 - 15:30
Back to Top