nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.

It was discovered that the GNU C Library did not properly handle integer overflows in the timezone handling code. An attacker could use this to possibly execute arbitrary code by convincing an application to load a maliciously constructed tzfile. (CVE-2009-5029)

It was discovered that the GNU C Library did not properly handle passwd.adjunct.byname map entries in the Network Information Service (NIS) code in the name service caching daemon (nscd). An attacker could use this to obtain the encrypted passwords of NIS accounts. This issue only affected Ubuntu 8.04 LTS. (CVE-2010-0015)

Chris Evans reported that the GNU C Library did not properly calculate the amount of memory to allocate in the fnmatch() code. An attacker could use this to cause a denial of service or possibly execute arbitrary code via a maliciously crafted UTF-8 string. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 10.10.
(CVE-2011-1071)

Tomas Hoger reported that an additional integer overflow was possible in the GNU C Library fnmatch() code. An attacker could use this to cause a denial of service via a maliciously crafted UTF-8 string. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1659)

Dan Rosenberg discovered that the addmntent() function in the GNU C Library did not report an error status for failed attempts to write to the /etc/mtab file. This could allow an attacker to corrupt /etc/mtab, possibly causing a denial of service or otherwise manipulate mount options. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS, Ubuntu 10.10 and Ubuntu 11.04. (CVE-2011-1089)

Harald van Dijk discovered that the locale program included with the GNU C library did not properly quote its output. This could allow a local attacker to possibly execute arbitrary code using a crafted localization string that was evaluated in a shell script. This issue only affected Ubuntu 8.04 LTS, Ubuntu 10.04 LTS and Ubuntu 10.10.
(CVE-2011-1095)

It was discovered that the GNU C library loader expanded the $ORIGIN dynamic string token when RPATH is composed entirely of this token.
This could allow an attacker to gain privilege via a setuid program that had this RPATH value. (CVE-2011-1658)

It was discovered that the GNU C library implementation of memcpy optimized for Supplemental Streaming SIMD Extensions 3 (SSSE3) contained a possible integer overflow. An attacker could use this to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS. (CVE-2011-2702)

John Zimmerman discovered that the Remote Procedure Call (RPC) implementation in the GNU C Library did not properly handle large numbers of connections. This could allow a remote attacker to cause a denial of service. (CVE-2011-4609)

It was discovered that the GNU C Library vfprintf() implementation contained a possible integer overflow in the format string protection code offered by FORTIFY_SOURCE. An attacker could use this flaw in conjunction with a format string vulnerability to bypass the format string protection and possibly execute arbitrary code. (CVE-2012-0864).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the following security issues found in glibc :

  - Specially crafted input to the fnmatch function could     cause an integer overflow. (CVE-2011-1071)

  - The output of the 'locale' command was not properly     quoted. (CVE-2011-1095)

  - Unprivileged users could read the NIS shadow database.
    (CVE-2010-0015)

  - Don't search the current directory if $ORIGIN is in     RPATH of libraries called by setuid binaries.
    (CVE-2011-0536) The update also includes fixes for     non-security bugs. Please refer to the package changelog     for details.

This update of glibc fixes various bugs and security issues :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, multi on     in /etc/host.conf would be ignored when nscd was used,     breaking e.g. resolving records in /etc/hosts where     single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Several security issues were fixed :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behavior, crashes and memory leaks were fixed :

  - nscd in the paranoia mode would crash on the periodic     restart in case one of the databases was disabled in the     nscd configuration.

  - When closing a widechar stdio stream, memory would     sometimes be leaked.

  - memcpy() on power6 would errorneously use a 64-bit     instruction within 32-bit code in certain corner cases.

  - jrand48() returns numbers in the wrong range on 64-bit     systems: Instead of [-231, +231), the value was always     positive and sometimes higher than the supposed upper     bound.

  - Roughly every 300 days of uptime, the times() function     would report an error for 4096 seconds, a side-effect of     how system calls are implemented on i386. glibc was     changed to never report an error and crash an     application that would trigger EFAULT by kernel (because     of invalid pointer passed to the times() syscall)     before.

  - getifaddrs() would report infiniband interfaces with     corrupted ifa_name structure field.

  - getgroups(-1) normally handles the invalid array size     gracefully by setting EINVAL. However, a crash would be     triggered in case the code was compiled using     '-DFORTIFYSOURCE=2 -O2'.

  - Pthread cleanup handlers would not always be invoked on     thread cancellation (e.g. in RPC code, but also in other     parts of glibc that may hang outside of a syscall) -     glibc is now compiled with

    -fasynchronous-unwind-tables. Some other minor issues     were fixed :

  - There was a problem with sprof<->dlopen() interaction     due to a missing flag in the internal dlopen() wrapper.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

CVE-2010-0015: Some setups (mainly Solaris-based legacy setups) include shadow information (password hashes) as so-called 'adjunct passwd' table, mangling it with the rest of passwd columns instead of keeping it in the shadow table. Normally, Solaris will disclose this information only to clients bound to a priviledged port, but when nscd is deployed on the client, getpwnam() would disclose the password hashes to all users. New mode 'adjunct as shadow' can now be enabled in /etc/default/nss that will move the password hashes from the world-readable passwd table to emulated shadow table (that is not cached by nscd).

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, `multi     on` in /etc/host.conf would be ignored when nscd was     used, breaking e.g. resolving records in /etc/hosts     where single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Multiple vulnerabilities was discovered and fixed in glibc :

Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391 (CVE-2009-4880).

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function (CVE-2010-0015).

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request (CVE-2010-0296).

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header (CVE-2010-0830).

The updated packages have been patched to correct these issues.

Multiple vulnerabilities was discovered and fixed in glibc :

Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391 (CVE-2009-4880).

Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391 (CVE-2009-4881).

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function (CVE-2010-0015).

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request (CVE-2010-0296).

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header (CVE-2010-0830).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Christoph Pleger has discovered that the GNU C Library (aka glibc) and its derivatives add information from the passwd.adjunct.byname map to entries in the passwd map, which allows local users to obtain the encrypted passwords of NIS accounts by calling the getpwnam function.

ID	Name	Product	Family	Severity
58318	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : eglibc, glibc vulnerabilities (USN-1396-1)	Nessus	Ubuntu Local Security Checks	high
57106	SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)	Nessus	SuSE Local Security Checks	high
55441	SuSE 11.1 Security Update : glibc (SAT Patch Number 4572)	Nessus	SuSE Local Security Checks	high
50912	SuSE 11 / 11.1 Security Update : glibc (SAT Patch Numbers 3392 / 3393)	Nessus	SuSE Local Security Checks	high
50377	SuSE 10 Security Update : glibc (ZYPP Patch Number 7201)	Nessus	SuSE Local Security Checks	high
50367	openSUSE Security Update : glibc (openSUSE-SU-2010:0914-1)	Nessus	SuSE Local Security Checks	high
48185	Mandriva Linux Security Advisory : glibc (MDVSA-2010:112)	Nessus	Mandriva Local Security Checks	high
46849	Mandriva Linux Security Advisory : glibc (MDVSA-2010:111)	Nessus	Mandriva Local Security Checks	high
44838	Debian DSA-1973-1 : glibc, eglibc - information disclosure	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-0015

high

Tenable Plugins

high

high

high

high

high

high

high

high

high