The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries :

  - Kernel
  - krb5
  - glibc
  - mtp2sas
  - mptsas
  - mptspi

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including arbitrary code execution vulnerabilities, in several third-party components and libraries :

  - DHCP
  - glibc

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

  - Correct test for detecting cycle during topo sort     (#729661)

  - Check values from TZ file header (#767688)

  - Complete the numeric settings fix (#675259)

  - Complete the change for error codes from pthread_create     (#707998)

  - Truncate time values in Linux futimes when falling back     to utime (#758252)

  - Update systemtaparches

  - Add rules to build libresolv with SSP flags (#756453)

  - Fix PLT reference

  - Workaround misconfigured system (#702300)

  - Update systemtaparches

  - Correct cycle detection during dependency sorting     (#729661)

  - Add gdb hooks (#711924)

  - Fix alloca accounting in strxfm and strcoll (#585433)

  - Correct cycle detection during dependency sorting     (#729661)

  - ldd: never run file directly (#531160)

  - Implement greedy matching of weekday and month names     (#657570)

  - Fix incorrect numeric settings (#675259)

  - Implement new mode for NIS passwd.adjunct.byname table     (#678318)

  - Query NIS domain only when needed (#703345)

  - Count total processors using sysfs (#706894)

  - Translate clone error if necessary (#707998)

  - Workaround kernel clobbering robust list (#711531)

  - Use correct type when casting d_tag (#599056,     CVE-2010-0830)

  - Report write error in addmnt even for cached streams     (#688980, CVE-2011-1089)

  - Don't underestimate length of DST substitution (#694655)

  - Don't allocate executable stack when it cannot be     allocated in the first 4G (#448011)

  - Initialize resolver state in nscd (#676039)

  - No cancel signal in unsafe places (#684808)

  - Check size of pattern in wide character representation     in fnmatch (#681054)

  - Avoid too much stack use in fnmatch (#681054,     CVE-2011-1071)

  - Properly quote output of locale (#625893, CVE-2011-1095)

  - Don't leave empty element in rpath when skipping the     first element, ignore rpath elements containing     non-isolated use of $ORIGIN when privileged (#667974,     CVE-2011-0536)

  - Fix handling of newline in addmntent (#559579,     CVE-2010-0296)

  - Don't ignore $ORIGIN in libraries (#670988)

  - Fix false assertion (#604796)

  - Fix ordering of DSO constructors and destructors     (#604796)

  - Fix typo (#531576)

  - Fix concurrency problem between dl_open and     dl_iterate_phdr (#649956)

  - Require suid bit on audit objects in privileged programs     (#645678, CVE-2010-3856)

  - Never expand $ORIGIN in privileged programs (#643819,     CVE-2010-3847)

  - Add timestamps to nscd logs (#527558)

  - Fix index wraparound handling in memusage (#531576)

  - Handle running out of buffer space with IPv6 mapping     enabled (#533367)

  - Don't deadlock in __dl_iterate_phdr while (un)loading     objects (#549813)

  - Avoid alloca in setenv for long strings (#559974)

  - Recognize POWER7 and ISA 2.06 (#563563)

  - Add support for AT_BASE_PLATFORM (#563599)

  - Restore locking in free_check (#585674)

  - Fix lookup of collation sequence value during regexp     matching (#587360)

  - Fix POWER6 memcpy/memset (#579011)

  - Fix scope handling during dl_close (#593675)

  - Enable -fasynchronous-unwind-tables throughout (#593047)

  - Fix crash when aio thread creation fails (#566712)

The remote VMware ESXi 5.0 host is affected by the following security vulnerabilities :

  - A security bypass vulnerability exists in the e1000     driver in the Linux kernel due to improper handling of     Ethernet frames that exceed the MTU. An unauthenticated,     remote attacker can exploit this, via trailing payload     data, to bypass packet filters. (CVE-2009-4536)

  - An error exists in the file misc/mntent_r.c that could     allow a local attacker to cause denial of service     conditions. (CVE-2010-0296)

  - An error exists related to glibc, the dynamic linker     and '$ORIGIN' substitution that could allow privilege     escalation. (CVE-2011-0536)

  - An error exists in the function 'fnmatch' in the file     posix/fnmatch.c that could allow arbitrary code     execution. (CVE-2011-1071)

  - An error exists in the file locale/programs/locale.c     related to localization environment variables that     could allow privilege escalation. (CVE-2011-1095)

  - An error exists related to glibc, the dynamic linker     and 'RPATH' that could allow privilege escalation.
    (CVE-2011-1658)

  - An error exists in the function 'fnmatch' related to     UTF-8 string handling that could allow privilege     escalation. (CVE-2011-1659)

From Red Hat Security Advisory 2012:0125 :

Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029)

A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064)

It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830)

It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)

It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089)

It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)

An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash.
(CVE-2011-1659)

A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609)

Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830.

This update also fixes the following bug :

* When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009)

Users should upgrade to these updated packages, which resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0412 advisory.

    - Avoid too much stack use in fnmatch (#681054, CVE-2011-1071)
    - Properly quote output of locale (#625893, CVE-2011-1095)
    - Don't leave empty element in rpath when skipping the first element,       ignore rpath elements containing non-isolated use of  when       privileged (#667974, CVE-2011-0536)
    - Fix handling of newline in addmntent (#559579, CVE-2010-0296)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029)

A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064)

It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830)

It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)

It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089)

It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)

An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash.
(CVE-2011-1659)

A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609)

This update also fixes the following bug :

  - When using an nscd package that is a different version     than the glibc package, the nscd service could fail to     start. This update makes the nscd package require a     specific glibc version to prevent this problem.

Users should upgrade to these updated packages, which resolve these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0125 advisory.

  - glibc: __tzfile_read integer overflow to buffer overflow (CVE-2009-5029)

  - glibc: ldd unexpected code execution issue (CVE-2009-5064)

  - glibc: Improper encoding of names with certain special character in utilities for writing to mtab table     (CVE-2010-0296)

  - glibc: ld.so d_tag signedness error in elf_get_dynamic_info (CVE-2010-0830)

  - glibc: fnmatch() alloca()-based memory corruption flaw (CVE-2011-1071, CVE-2011-1659)

  - glibc: Suid mount helpers fail to anticipate RLIMIT_FSIZE (CVE-2011-1089)

  - glibc: insufficient quoting in the locale command output (CVE-2011-1095)

  - glibc: svc_run() produces high cpu usage when accept() fails with EMFILE error (CVE-2011-4609)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated glibc packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2009-5029)

A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. (CVE-2009-5064)

It was discovered that the glibc addmntent() function, used by various mount helper utilities, did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into the mtab (mounted file systems table) file via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF (Executable and Linking Format) files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2010-0830)

It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)

It was found that the glibc addmntent() function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab (mounted file systems table) file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. (CVE-2011-1089)

It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)

An integer overflow flaw was found in the glibc fnmatch() function. If an attacker supplied a long UTF-8 string to an application linked against glibc, it could cause the application to crash.
(CVE-2011-1659)

A denial of service flaw was found in the remote procedure call (RPC) implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. (CVE-2011-4609)

Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830.

This update also fixes the following bug :

* When using an nscd package that is a different version than the glibc package, the nscd service could fail to start. This update makes the nscd package require a specific glibc version to prevent this problem. (BZ#657009)

Users should upgrade to these updated packages, which resolve these issues.

This update of glibc fixes the following bugs and security issues :

  - The implementation of initgroups() of the nss_compat     module omits all NIS groups at the second invocation     within the same process, and also uses a needlessly     inefficient method to determine the NIS groups.

  - An integer overflow that allows arbitrary code execution     by running ld.so --verify could be exploited by a     specially crafted binary. (CVE-2010-0830)

  - The addmntent() function does not escape the newline     character properly, allowing the user to insert     arbitrary newlines to /etc/mtab. This could be exploited     to insert custom entries into /etc/mtab if addmntent()     gets called by a setuid mount binary that does not     perform extra input checking. (CVE-2010-0296)

a. ESX third-party update for Service Console kernel

   This update takes the console OS kernel package to    kernel-2.6.18-238.9.1 which resolves multiple security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798,    CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015,    CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086,    CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477,    CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865,    CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904,    CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080,    CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158,    CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243,    CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251,    CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346,    CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710,    CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues.

b. ESX third-party update for Service Console krb5 RPMs

   This patch updates the krb5-libs and krb5-workstation RPMs of the    console OS to version 1.6.1-55.el5_6.1, which resolves multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282    to these issues.

c. ESXi and ESX update to third-party component glibc

   The glibc third-party library is updated to resolve multiple    security issues.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071,    CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues.

d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi

   The mptsas, mpt2sas, and mptspi drivers are updated which addresses    multiple security issues in the mpt2sas driver.

   The Common Vulnerabilities and Exposures project (cve.mitre.org) has    assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.

a. Service Console update for DHCP

    The DHCP client daemon, dhclient, does not properly sanatize     certain options in DHCP server replies. An attacker could send a     specially crafted DHCP server reply, that is saved on     the client system and evaluated by a process that assumes the     option is trusted. This could lead to arbitrary code execution     with the privileges of the evaluating process.

    The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the name CVE-2011-0997 to this issue.

b. Service Console update for glibc

    This patch updates the glibc package for ESX service console to     glibc-2.5-58.7602.vmw. This fixes multiple security issues in     glibc, glibc-common and nscd including possible local privilege     escalation.
     The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the identifiers CVE-2010-0296, CVE-2011-0536,     CVE-2011-1095, CVE-2011-1071, CVE-2011-1658 and CVE-2011-1659 to     these issues.

Updated glibc packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

The fix for CVE-2010-3847 introduced a regression in the way the dynamic loader expanded the $ORIGIN dynamic string token specified in the RPATH and RUNPATH entries in the ELF library header. A local attacker could use this flaw to escalate their privileges via a setuid or setgid program using such a library. (CVE-2011-0536)

It was discovered that the glibc addmntent() function did not sanitize its input properly. A local attacker could possibly use this flaw to inject malformed lines into /etc/mtab via certain setuid mount helpers, if the attacker were allowed to mount to an arbitrary directory under their control. (CVE-2010-0296)

It was discovered that the glibc fnmatch() function did not properly restrict the use of alloca(). If the function was called on sufficiently large inputs, it could cause an application using fnmatch() to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2011-1071)

It was discovered that the locale command did not produce properly escaped output as required by the POSIX specification. If an attacker were able to set the locale environment variables in the environment of a script that performed shell evaluation on the output of the locale command, and that script were run with different privileges than the attacker's, it could execute arbitrary code with the privileges of the script. (CVE-2011-1095)

All users should upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0412 advisory.

  - glibc: Improper encoding of names with certain special character in utilities for writing to mtab table     (CVE-2010-0296)

  - glibc: CVE-2010-3847 fix causes linker to search CWD when running privileged program with $ORIGIN in     R*PATH (CVE-2011-0536)

  - glibc: fnmatch() alloca()-based memory corruption flaw (CVE-2011-1071, CVE-2011-1659)

  - glibc: insufficient quoting in the locale command output (CVE-2011-1095)

  - glibc: ld.so insecure handling of privileged programs' RPATHs with $ORIGIN (CVE-2011-1658)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of glibc fixes various bugs and security issues :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, multi on     in /etc/host.conf would be ignored when nscd was used,     breaking e.g. resolving records in /etc/hosts where     single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

The remote host is affected by the vulnerability described in GLSA-201011-01 (GNU C library: Multiple vulnerabilities)

    Multiple vulnerabilities were found in glibc, amongst others the     widely-known recent LD_AUDIT and $ORIGIN issues. For further     information please consult the CVE entries referenced below.
  Impact :

    A local attacker could execute arbitrary code as root, cause a Denial     of Service, or gain privileges. Additionally, a user-assisted remote     attacker could cause the execution of arbitrary code, and a     context-dependent attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Several security issues were fixed :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behavior, crashes and memory leaks were fixed :

  - nscd in the paranoia mode would crash on the periodic     restart in case one of the databases was disabled in the     nscd configuration.

  - When closing a widechar stdio stream, memory would     sometimes be leaked.

  - memcpy() on power6 would errorneously use a 64-bit     instruction within 32-bit code in certain corner cases.

  - jrand48() returns numbers in the wrong range on 64-bit     systems: Instead of [-231, +231), the value was always     positive and sometimes higher than the supposed upper     bound.

  - Roughly every 300 days of uptime, the times() function     would report an error for 4096 seconds, a side-effect of     how system calls are implemented on i386. glibc was     changed to never report an error and crash an     application that would trigger EFAULT by kernel (because     of invalid pointer passed to the times() syscall)     before.

  - getifaddrs() would report infiniband interfaces with     corrupted ifa_name structure field.

  - getgroups(-1) normally handles the invalid array size     gracefully by setting EINVAL. However, a crash would be     triggered in case the code was compiled using     '-DFORTIFYSOURCE=2 -O2'.

  - Pthread cleanup handlers would not always be invoked on     thread cancellation (e.g. in RPC code, but also in other     parts of glibc that may hang outside of a syscall) -     glibc is now compiled with

    -fasynchronous-unwind-tables. Some other minor issues     were fixed :

  - There was a problem with sprof<->dlopen() interaction     due to a missing flag in the internal dlopen() wrapper.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

CVE-2010-0015: Some setups (mainly Solaris-based legacy setups) include shadow information (password hashes) as so-called 'adjunct passwd' table, mangling it with the rest of passwd columns instead of keeping it in the shadow table. Normally, Solaris will disclose this information only to clients bound to a priviledged port, but when nscd is deployed on the client, getpwnam() would disclose the password hashes to all users. New mode 'adjunct as shadow' can now be enabled in /etc/default/nss that will move the password hashes from the world-readable passwd table to emulated shadow table (that is not cached by nscd).

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, `multi     on` in /etc/host.conf would be ignored when nscd was     used, breaking e.g. resolving records in /etc/hosts     where single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Several security issues were fixed :

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

Also one non-security issue was fixed: - nscd in the paranoia mode would crash on the periodic restart in case one of the databases was disabled in the nscd configuration.

In addition, the timezone information was updated to the level of 2010l, including the following changes :

  - Africa/Cairo (Egypt) and Asia/Gaza (Palestine) do not     use daylight saving during the month of Ramadan in order     to prevent Muslims from fasting one hour longer.
    http://www.timeanddate.com/news/time/egypt-ends-dst-2010     .html     http://www.timeanddate.com/news/time/westbank-gaza-end-d     st-2010.html

  - Africa/Casablanca (Marocco) has spent the period from     May 2 to Aug 8 using daylight saving. Marocco adopted     regular daylight saving, but the start and end dates     vary every year.
    http://www.timeanddate.com/news/time/morocco-starts-dst-     2010.html

  - America/Argentina/San_Luis (Argentina region) local     government did not terminate its DST period as planned     and instead decided to extend its use of the UTC-3 time     indefinitely.
    http://www.worldtimezone.com/dst_news/dst_news_argentina     08.html

New zones :

  - America/Bahia_Banderas (Mexican state of Nayarit) has     declared that it is to follow the UCT-6 time instead of     UCT-7, with the aim to have the same time as the nearby     city of Puerto Vallarta.
    http://www.worldtimezone.com/dst_news/dst_news_mexico08.
    html

Historical changes :

  - Asia/Taipei information on DST usage listed 1980 as one     year using DST, which should read 1979 instead according     to government resources.

  - Europe/Helsinki, before switching to Central European     standard DST in 1983, trialled DST for two years.
    However, the database omitted to specify that in these     trials of 1981 and 1982, switches have been made one     hour earlier than in 1983.

Spelling changes in Micronesia: - Pacific/Truk has been renamed to Pacific/Chuuk in 1989. - Pacific/Ponape has been renamed to Pacific/Pohnpei in 1984.

Multiple vulnerabilities was discovered and fixed in glibc :

Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391 (CVE-2009-4880).

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function (CVE-2010-0015).

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request (CVE-2010-0296).

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header (CVE-2010-0830).

The updated packages have been patched to correct these issues.

Several vulnerabilities have been discovered in the GNU C Library (aka glibc) and its derivatives. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1391, CVE-2009-4880, CVE-2009-4881     Maksymilian Arciemowicz discovered that the GNU C     library did not correctly handle integer overflows in     the strfmon family of functions. If a user or automated     system were tricked into processing a specially crafted     format string, a remote attacker could crash     applications, leading to a denial of service.

  - CVE-2010-0296     Jeff Layton and Dan Rosenberg discovered that the GNU C     library did not correctly handle newlines in the mntent     family of functions. If a local attacker were able to     inject newlines into a mount entry through other     vulnerable mount helpers, they could disrupt the system     or possibly gain root privileges.

  - CVE-2010-0830     Dan Rosenberg discovered that the GNU C library did not     correctly validate certain ELF program headers. If a     user or automated system were tricked into verifying a     specially crafted ELF program, a remote attacker could     execute arbitrary code with user privileges.

Multiple vulnerabilities was discovered and fixed in glibc :

Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391 (CVE-2009-4880).

Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391 (CVE-2009-4881).

nis/nss_nis/nis-pwd.c in the GNU C Library (aka glibc or libc6) 2.7 and Embedded GLIBC (EGLIBC) 2.10.2 adds information from the passwd.adjunct.byname map to entries in the passwd map, which allows remote attackers to obtain the encrypted passwords of NIS accounts by calling the getpwnam function (CVE-2010-0015).

The encode_name macro in misc/mntent_r.c in the GNU C Library (aka glibc or libc6) 2.11.1 and earlier, as used by ncpmount and mount.cifs, does not properly handle newline characters in mountpoint names, which allows local users to cause a denial of service (mtab corruption), or possibly modify mount options and gain privileges, via a crafted mount request (CVE-2010-0296).

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header (CVE-2010-0830).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

Maksymilian Arciemowicz discovered that the GNU C library did not correctly handle integer overflows in the strfmon function. If a user or automated system were tricked into processing a specially crafted format string, a remote attacker could crash applications, leading to a denial of service. (Ubuntu 10.04 was not affected.) (CVE-2008-1391)

Jeff Layton and Dan Rosenberg discovered that the GNU C library did not correctly handle newlines in the mntent family of functions. If a local attacker were able to inject newlines into a mount entry through other vulnerable mount helpers, they could disrupt the system or possibly gain root privileges. (CVE-2010-0296)

Dan Rosenberg discovered that the GNU C library did not correctly validate certain ELF program headers. If a user or automated system were tricked into verifying a specially crafted ELF program, a remote attacker could execute arbitrary code with user privileges.
(CVE-2010-0830).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
89680	VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)	Nessus	Misc.	high
89679	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0010) (remote check)	Nessus	Misc.	high
81118	OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)	Nessus	OracleVM Local Security Checks	high
70880	ESXi 5.0 < Build 515841 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
68455	Oracle Linux 4 : glibc (ELSA-2012-0125)	Nessus	Oracle Linux Local Security Checks	high
68244	Oracle Linux 5 : glibc (ELSA-2011-0412)	Nessus	Oracle Linux Local Security Checks	high
61243	Scientific Linux Security Update : glibc on SL4.x i386/x86_64 (20120213)	Nessus	Scientific Linux Local Security Checks	high
57928	RHEL 4 : glibc (RHSA-2012:0125)	Nessus	Red Hat Local Security Checks	high
57923	CentOS 4 : glibc (CESA-2012:0125)	Nessus	CentOS Local Security Checks	high
57105	SuSE 11.1 Security Update : glibc (SAT Patch Number 2700)	Nessus	SuSE Local Security Checks	high
56508	VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console	Nessus	VMware ESX Local Security Checks	high
55747	VMSA-2011-0010 : VMware ESX third-party updates for Service Console packages glibc and dhcp	Nessus	VMware ESX Local Security Checks	high
53430	CentOS 5 : glibc (CESA-2011:0412)	Nessus	CentOS Local Security Checks	high
53291	RHEL 5 : glibc (RHSA-2011:0412)	Nessus	Red Hat Local Security Checks	high
51601	SuSE 11.1 Security Update : glibc (SAT Patch Number 2700)	Nessus	SuSE Local Security Checks	high
50912	SuSE 11 / 11.1 Security Update : glibc (SAT Patch Numbers 3392 / 3393)	Nessus	SuSE Local Security Checks	high
50605	GLSA-201011-01 : GNU C library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50377	SuSE 10 Security Update : glibc (ZYPP Patch Number 7201)	Nessus	SuSE Local Security Checks	high
50373	openSUSE Security Update : glibc (openSUSE-SU-2010:0913-1)	Nessus	SuSE Local Security Checks	high
50367	openSUSE Security Update : glibc (openSUSE-SU-2010:0914-1)	Nessus	SuSE Local Security Checks	high
49758	SuSE9 Security Update : glibc (YOU Patch Number 12641)	Nessus	SuSE Local Security Checks	high
48185	Mandriva Linux Security Advisory : glibc (MDVSA-2010:112)	Nessus	Mandriva Local Security Checks	high
46861	Debian DSA-2058-1 : glibc, eglibc - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
46849	Mandriva Linux Security Advisory : glibc (MDVSA-2010:111)	Nessus	Mandriva Local Security Checks	high
46731	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : glibc, eglibc vulnerabilities (USN-944-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2010-0296

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high