Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec.

This update of glibc fixes various bugs and security issues :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, multi on     in /etc/host.conf would be ignored when nscd was used,     breaking e.g. resolving records in /etc/hosts where     single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Several security issues were fixed :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behavior, crashes and memory leaks were fixed :

  - nscd in the paranoia mode would crash on the periodic     restart in case one of the databases was disabled in the     nscd configuration.

  - When closing a widechar stdio stream, memory would     sometimes be leaked.

  - memcpy() on power6 would errorneously use a 64-bit     instruction within 32-bit code in certain corner cases.

  - jrand48() returns numbers in the wrong range on 64-bit     systems: Instead of [-231, +231), the value was always     positive and sometimes higher than the supposed upper     bound.

  - Roughly every 300 days of uptime, the times() function     would report an error for 4096 seconds, a side-effect of     how system calls are implemented on i386. glibc was     changed to never report an error and crash an     application that would trigger EFAULT by kernel (because     of invalid pointer passed to the times() syscall)     before.

  - getifaddrs() would report infiniband interfaces with     corrupted ifa_name structure field.

  - getgroups(-1) normally handles the invalid array size     gracefully by setting EINVAL. However, a crash would be     triggered in case the code was compiled using     '-DFORTIFYSOURCE=2 -O2'.

  - Pthread cleanup handlers would not always be invoked on     thread cancellation (e.g. in RPC code, but also in other     parts of glibc that may hang outside of a syscall) -     glibc is now compiled with

    -fasynchronous-unwind-tables. Some other minor issues     were fixed :

  - There was a problem with sprof<->dlopen() interaction     due to a missing flag in the internal dlopen() wrapper.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

CVE-2010-0015: Some setups (mainly Solaris-based legacy setups) include shadow information (password hashes) as so-called 'adjunct passwd' table, mangling it with the rest of passwd columns instead of keeping it in the shadow table. Normally, Solaris will disclose this information only to clients bound to a priviledged port, but when nscd is deployed on the client, getpwnam() would disclose the password hashes to all users. New mode 'adjunct as shadow' can now be enabled in /etc/default/nss that will move the password hashes from the world-readable passwd table to emulated shadow table (that is not cached by nscd).

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, `multi     on` in /etc/host.conf would be ignored when nscd was     used, breaking e.g. resolving records in /etc/hosts     where single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Several security issues were fixed :

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

Also one non-security issue was fixed: - nscd in the paranoia mode would crash on the periodic restart in case one of the databases was disabled in the nscd configuration.

In addition, the timezone information was updated to the level of 2010l, including the following changes :

  - Africa/Cairo (Egypt) and Asia/Gaza (Palestine) do not     use daylight saving during the month of Ramadan in order     to prevent Muslims from fasting one hour longer.
    http://www.timeanddate.com/news/time/egypt-ends-dst-2010     .html     http://www.timeanddate.com/news/time/westbank-gaza-end-d     st-2010.html

  - Africa/Casablanca (Marocco) has spent the period from     May 2 to Aug 8 using daylight saving. Marocco adopted     regular daylight saving, but the start and end dates     vary every year.
    http://www.timeanddate.com/news/time/morocco-starts-dst-     2010.html

  - America/Argentina/San_Luis (Argentina region) local     government did not terminate its DST period as planned     and instead decided to extend its use of the UTC-3 time     indefinitely.
    http://www.worldtimezone.com/dst_news/dst_news_argentina     08.html

New zones :

  - America/Bahia_Banderas (Mexican state of Nayarit) has     declared that it is to follow the UCT-6 time instead of     UCT-7, with the aim to have the same time as the nearby     city of Puerto Vallarta.
    http://www.worldtimezone.com/dst_news/dst_news_mexico08.
    html

Historical changes :

  - Asia/Taipei information on DST usage listed 1980 as one     year using DST, which should read 1979 instead according     to government resources.

  - Europe/Helsinki, before switching to Central European     standard DST in 1983, trialled DST for two years.
    However, the database omitted to specify that in these     trials of 1981 and 1982, switches have been made one     hour earlier than in 1983.

Spelling changes in Micronesia: - Pacific/Truk has been renamed to Pacific/Chuuk in 1989. - Pacific/Ponape has been renamed to Pacific/Pohnpei in 1984.

Several vulnerabilities have been discovered in the GNU C Library (aka glibc) and its derivatives. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1391, CVE-2009-4880, CVE-2009-4881     Maksymilian Arciemowicz discovered that the GNU C     library did not correctly handle integer overflows in     the strfmon family of functions. If a user or automated     system were tricked into processing a specially crafted     format string, a remote attacker could crash     applications, leading to a denial of service.

  - CVE-2010-0296     Jeff Layton and Dan Rosenberg discovered that the GNU C     library did not correctly handle newlines in the mntent     family of functions. If a local attacker were able to     inject newlines into a mount entry through other     vulnerable mount helpers, they could disrupt the system     or possibly gain root privileges.

  - CVE-2010-0830     Dan Rosenberg discovered that the GNU C library did not     correctly validate certain ELF program headers. If a     user or automated system were tricked into verifying a     specially crafted ELF program, a remote attacker could     execute arbitrary code with user privileges.

Maksymilian Arciemowicz discovered that the GNU C library did not correctly handle integer overflows in the strfmon function. If a user or automated system were tricked into processing a specially crafted format string, a remote attacker could crash applications, leading to a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391)

Jeff Layton and Dan Rosenberg discovered that the GNU C library did not correctly handle newlines in the mntent family of functions. If a local attacker were able to inject newlines into a mount entry through other vulnerable mount helpers, they could disrupt the system or possibly gain root privileges. (CVE-2010-0296)

Dan Rosenberg discovered that the GNU C library did not correctly validate certain ELF program headers. If a user or automated system were tricked into verifying a specially crafted ELF program, a remote attacker could execute arbitrary code with user privileges.
(CVE-2010-0830).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.6.  Mac OS X 10.5.6 contains security fixes for the following products : 

  - ATS
  - BOM
  - CoreGraphics
  - CoreServices
  - CoreTypes
  - Flash Player Plug-in
  - Kernel
  - Libsystem
  - Managed Client
  - network_cmds
  - Podcast Producer
  - UDF

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.6. 

Mac OS X 10.5.6 contains security fixes for the following products :

  - ATS
  - BOM
  - CoreGraphics
  - CoreServices
  - CoreTypes
  - Flash Player Plug-in
  - Kernel
  - Libsystem
  - Managed Client
  - network_cmds
  - Podcast Producer
  - UDF

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2008-008 applied. 

This security update contains fixes for the following products :

  - BOM
  - CoreGraphics
  - CoreServices
  - Flash Player Plug-in
  - Libsystem
  - network_cmds
  - UDF

ID	Name	Product	Family	Severity
50912	SuSE 11 / 11.1 Security Update : glibc (SAT Patch Numbers 3392 / 3393)	Nessus	SuSE Local Security Checks	high
50377	SuSE 10 Security Update : glibc (ZYPP Patch Number 7201)	Nessus	SuSE Local Security Checks	high
50373	openSUSE Security Update : glibc (openSUSE-SU-2010:0913-1)	Nessus	SuSE Local Security Checks	high
50367	openSUSE Security Update : glibc (openSUSE-SU-2010:0914-1)	Nessus	SuSE Local Security Checks	high
49758	SuSE9 Security Update : glibc (YOU Patch Number 12641)	Nessus	SuSE Local Security Checks	high
46861	Debian DSA-2058-1 : glibc, eglibc - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
46731	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : glibc, eglibc vulnerabilities (USN-944-1)	Nessus	Ubuntu Local Security Checks	high
4790	Mac OS X < 10.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
4789	Mac OS X < 10.5.6 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
35111	Mac OS X 10.5.x < 10.5.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
35110	Mac OS X Multiple Vulnerabilities (Security Update 2008-008)	Nessus	MacOS X Local Security Checks	critical
800794	Mac OS X < 10.5.6 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2008-1391

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

critical

critical

critical

high