The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.

Recently, Trustix Secure Linux discovered some vulnerabilities in the libc6 package. The utilities 'catchsegv' and 'glibcbug' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated glibc packages that address several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

Flaws in the catchsegv and glibcbug scripts were discovered. A local user could utilize these flaws to overwrite files via a symlink attack on temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0968 and CVE-2004-1382 to these issues.

It was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.

This erratum also addresses the following bugs in the GNU C Library: - Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation - Fixed poll on Itanium - Now allows setenv/putenv in shared library constructors

Users of glibc are advised to upgrade to these erratum packages that remove the unnecessary glibcbug script and contain backported patches to correct these other issues.

Several insecure uses of temporary files have been discovered in support scripts in the libc6 package which provides the c library for a GNU/Linux system. Trustix developers found that the catchsegv script uses temporary files insecurely. Openwall developers discovered insecure temporary files in the glibcbug script. These scripts are vulnerable to a symlink attack.

The Trustix developers discovered that the catchsegv and glibcbug utilities, part of the glibc package, created temporary files in an insecure manner. This could allow for a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.

The updated packages have been patched to correct this issue.

Updated glibc packages that address several bugs and implement some enhancements are now available.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

This errata fixes several bugs in the GNU C Library.

Fixes include (in addition to enclosed Bugzilla entries) :

  - fixed 32-bit atomic operations on 64-bit powerpc - fixed
    -m32 -I /usr/include/nptl compilation on AMD64 - NPTL     <pthread.h> should now be usable in C++ code or
    -pedantic -std=c89 C - rwlocks are now available also in     the _POSIX_C_SOURCE=200112L namespace - pthread_once is     no longer throw(), as the callback routine might throw -     pthread_create now correctly returns EAGAIN when thread     couldn't be created because of lack of memory - fixed     NPTL stack freeing in case of pthread_create failure     with detached thread - fixed pthread_mutex_timedlock on     i386 and AMD64 - Itanium gp saving fix in linuxthreads -     fixed s390/s390x unwinding tests done during     cancellation if stack frames are small - fixed     fnmatch(3) backslash handling - fixed out of memory     behaviour of syslog(3) - resolver ID randomization -     fixed fim (NaN, NaN) - glob(3) fixes for dangling     symlinks - catchsegv fixed to work with both 32-bit and     64-bit binaries on x86-64, s390x and ppc - fixed     reinitialization of _res when using NPTL stack cache -     updated bug reporting instructions, removed glibcbug     script - fixed infinite loop in iconv with some options
    - fixed inet_aton return value - CPU friendlier busy     waiting in linuxthreads on EM64T and IA-64 - avoid     blocking/masking debug signal in linuxthreads - fixed     locale program output when neither LC_ALL nor LANG is     set - fixed using of uninitialized memory in localedef -     fixed mntent_r escape processing - optimized mtrace     script - linuxthread_db fixes on ppc64 - cfi     instructions in x86-64 linuxthreads vfork - some
    _POSIX_C_SOURCE=200112L namespace fixes

All users of glibc should upgrade to these updated packages, which resolve these issues.

The remote host is affected by the vulnerability described in GLSA-200410-19 (glibc: Insecure tempfile handling in catchsegv script)

    The catchsegv script creates temporary files in world-writeable directories     with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary files     directory, pointing to a valid file somewhere on the filesystem. When     catchsegv script is called, this would result in the file being overwritten     with the rights of the user running the utility, which could be the root     user.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
20656	Ubuntu 4.10 : Standard C library script vulnerabilities (USN-4-1)	Nessus	Ubuntu Local Security Checks	low
18160	RHEL 2.1 : glibc (RHSA-2005:261)	Nessus	Red Hat Local Security Checks	low
16150	Debian DSA-636-1 : glibc - insecure temporary files	Nessus	Debian Local Security Checks	low
16076	Mandrake Linux Security Advisory : glibc (MDKSA-2004:159)	Nessus	Mandriva Local Security Checks	low
16018	RHEL 3 : glibc (RHSA-2004:586)	Nessus	Red Hat Local Security Checks	low
15538	GLSA-200410-19 : glibc: Insecure tempfile handling in catchsegv script	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-0968

medium

Tenable Plugins

low

low

low

low

low

low