The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.

glibc has been updated to fix security issues :

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, CVE-2012-6656, bsc#894553, bsc#894556,     GLIBC BZ #17325, GLIBC BZ #14134)

  - Fixed a stack overflow during hosts parsing     (CVE-2013-4357)

  - Copy filename argument in     posix_spawn_file_actions_addopen (CVE-2014-4043,     bsc#882600, BZ #17048)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc has been updated to fix one security issue and several bugs :

Security issue fixed :

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, CVE-2012-6656)

  - Fixed a stack overflow during hosts parsing     (CVE-2013-4357)

Bugs fixed :

  - don't touch user-controlled stdio locks in forked child     (bsc#864081, GLIBC BZ #12847)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

  - Add check for RTLD_DEEPBIND environment variable to     disable deepbinding of NSS modules (bsc#888860)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and two additional issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#836746: Avoid race between {, __de}allocate_stack     and __reclaim_stacks during fork.

  - bnc#844309: Fixed various overflows, reading large     /etc/hosts or long names. (CVE-2013-4357)

  - bnc#894553, bnc#894556: Fixed various crashes on invalid     input in IBM gconv modules. (CVE-2014-6040,     CVE-2012-6656)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library.

#553206 CVE-2015-1472 CVE-2015-1473

The scanf family of functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2012-3405

The printf family of functions do not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service.

CVE-2012-3406

The printf family of functions do not properly limit stack allocation, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string.

CVE-2012-3480

Multiple integer overflows in the strtod, strtof, strtold, strtod_l, and other related functions allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

CVE-2012-4412

Integer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.

CVE-2012-4424

Stack-based buffer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.

CVE-2013-0242

Buffer overflow in the extend_buffers function in the regular expression matcher allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.

CVE-2013-1914 CVE-2013-4458

Stack-based buffer overflow in the getaddrinfo function allows remote attackers to cause a denial of service (crash) via a hostname or IP address that triggers a large number of domain conversion results.

CVE-2013-4237

readdir_r allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a malicious NTFS image or CIFS service.

CVE-2013-4332

Multiple integer overflows in malloc/malloc.c allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the pvalloc, valloc, posix_memalign, memalign, or aligned_alloc functions.

CVE-2013-4357

The getaliasbyname, getaliasbyname_r, getaddrinfo, getservbyname, getservbyname_r, getservbyport, getservbyport_r, and glob functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2013-4788

When the GNU C library is statically linked into an executable, the PTR_MANGLE implementation does not initialize the random value for the pointer guard, so that various hardening mechanisms are not effective.

CVE-2013-7423

The send_dg function in resolv/res_send.c does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.

CVE-2013-7424

The getaddrinfo function may attempt to free an invalid pointer when handling IDNs (Internationalised Domain Names), which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2014-4043

The posix_spawn_file_actions_addopen function does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

For the oldstable distribution (squeeze), these problems have been fixed in version 2.11.3-4+deb6u5.

For the stable distribution (wheezy), these problems were fixed in version 2.13-38+deb7u8 or earlier.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04 LTS, the fix for CVE-2013-4357 introduced a memory leak in getaddrinfo. This update fixes the problem.

We apologize for the inconvenience.

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. (CVE-2013-4357)

It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-4458)

Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand restrictions in OpenSSH. (CVE-2014-0475)

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of service.
(CVE-2014-4043).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04 LTS, the security update cause a regression in certain environments that use the Name Service Caching Daemon (nscd), such as those configured for LDAP or MySQL authentication. In these environments, the nscd daemon may need to be stopped manually for name resolution to resume working so that updates can be downloaded, including environments configured for unattended updates.

We apologize for the inconvenience.

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS. (CVE-2013-4357)

It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-4458)

Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand restrictions in OpenSSH. (CVE-2014-0475)

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of service.
(CVE-2014-4043).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2306-1 advisory.

    Maksymilian Arciemowicz discovered that the GNU C Library incorrectly handled the getaddrinfo() function.
    An attacker could use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS.
    (CVE-2013-4357)

    It was discovered that the GNU C Library incorrectly handled the getaddrinfo() function. An attacker could     use this issue to cause a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04     LTS. (CVE-2013-4458)

    Stephane Chazelas discovered that the GNU C Library incorrectly handled locale environment variables. An     attacker could use this issue to possibly bypass certain restrictions such as the ForceCommand     restrictions in OpenSSH. (CVE-2014-0475)

    David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that the GNU C Library incorrectly handled     posix_spawn_file_actions_addopen() path arguments. An attacker could use this issue to cause a denial of     service. (CVE-2014-4043)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for the GNU Lib C fixes security issues, some bugs and introduces one new feature.

The following security issues have been fixed :

  - Various potential stack overflows in getaddrinfo() and     others were fixed. (bnc#844309). (CVE-2013-4357)

  - A stack (frame) overflow in getaddrinfo() when called     with AF_INET6. The following new feature has been     implemented:. (CVE-2013-4458)

  - On PowerLinux, a vDSO entry for getcpu() was added for     possible performance enhancements. (FATE#316816,     bnc#854445) The following issues have been fixed :

  - Performance problems with threads in
    __lll_lock_wait_private and __lll_unlock_wake_private.
    (bnc#836746)

  - IPv6: Memory leak in getaddrinfo() when many RRs are     returned. (bnc#863499)

  - Using profiling C library (-lc_p) can trigger a     segmentation fault. (bnc#872832)

ID	Name	Product	Family	Severity
83675	SUSE SLES10 Security Update : glibc (SUSE-SU-2015:0170-1)	Nessus	SuSE Local Security Checks	high
83673	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0164-1)	Nessus	SuSE Local Security Checks	high
83639	SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1129-1)	Nessus	SuSE Local Security Checks	high
82149	Debian DLA-165-1 : eglibc security update	Nessus	Debian Local Security Checks	high
77568	Ubuntu 10.04 LTS : eglibc regression (USN-2306-3)	Nessus	Ubuntu Local Security Checks	high
77019	Ubuntu 10.04 LTS : eglibc regression (USN-2306-2)	Nessus	Ubuntu Local Security Checks	high
76999	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2306-1)	Nessus	Ubuntu Local Security Checks	high
74351	SuSE 11.3 Security Update : glibc (SAT Patch Number 9262)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2013-4357

high

Tenable Plugins

high

high

high

high

high

high

high

medium