Buffer overflow in the gethostbyname_r and other unspecified NSS functions in the GNU C Library (aka glibc or libc6) before 2.22 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response, which triggers a call with a misaligned buffer.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - glibc: Incorrect handling of RPATH in elf/dl-load.c can be used to execute code loaded from arbitrary     libraries (CVE-2017-16997)

  - glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-     read (CVE-2019-9169)

  - In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses     alternatives, which allows attackers to cause a denial of service (assertion failure and application exit)     or trigger an incorrect result by attempting a regular-expression match. (CVE-2009-5155)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was discovered that the nss_files backend for the     Name Service Switch in glibc would return incorrect     data to applications or corrupt the heap (depending on     adjacent heap contents). A local attacker could     potentially use this flaw to execute arbitrary code on     the system.(CVE-2015-5277)

  - A directory traveral flaw was found in the way glibc     loaded locale files. An attacker able to make an     application use a specially crafted locale name value     (for example, specified in an LC_* environment     variable) could possibly use this flaw to execute     arbitrary code with the privileges of that     application.(CVE-2014-0475)

  - It was found that out-of-range time values passed to     the strftime() function could result in an     out-of-bounds memory access. This could lead to     application crash or, potentially, information     disclosure.(CVE-2015-8776)

  - The GNU C Library (aka glibc or libc6) before 2.27     contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related     to the processing of home directories using the ~     operator followed by a long string.(CVE-2017-15670)

  - The PTR_MANGLE implementation in the GNU C Library (aka     glibc or libc6) 2.4, 2.17, and earlier, and Embedded     GLIBC (EGLIBC) does not initialize the random value for     the pointer guard, which makes it easier for     context-dependent attackers to control execution flow     by leveraging a buffer-overflow vulnerability in an     application and using the known zero value pointer     guard to calculate a pointer address.(CVE-2013-4788)

  - An out-of-bounds read flaw was found in the way glibc's     iconv() function converted certain encoded data to     UTF-8. An attacker able to make an application call the     iconv() function with a specially crafted argument     could use this flaw to crash that     application.(CVE-2014-6040)

  - A stack overflow vulnerability was found in
    _nss_dns_getnetbyname_r. On systems with nsswitch     configured to include ''networks: dns'' with a     privileged or network-facing service that would attempt     to resolve user-provided network names, an attacker     could provide an excessively long network name,     resulting in stack corruption and code     execution.(CVE-2016-3075)

  - Integer overflow in string/strcoll_l.c in the GNU C     Library (aka glibc or libc6) 2.17 and earlier allows     context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string, which triggers a heap-based buffer     overflow.(CVE-2012-4412)

  - A heap-based buffer overflow flaw was found in glibc's     swscanf() function. An attacker able to make an     application call the swscanf() function could use this     flaw to crash that application or, potentially, execute     arbitrary code with the permissions of the user running     the application.(CVE-2015-1472)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-1914)

  - A stack overflow vulnerability was found in nan*     functions that could cause applications, which process     long strings with the nan function, to crash or,     potentially, execute arbitrary code.(CVE-2014-9761)

  - An out-of-bounds write flaw was found in the way the     glibc's readdir_r() function handled file system     entries longer than the NAME_MAX character constant. A     remote attacker could provide a specially crafted NTFS     or CIFS file system that, when processed by an     application using readdir_r(), would cause that     application to crash or, potentially, allow the     attacker to execute arbitrary code with the privileges     of the user running the application.(CVE-2013-4237)

  - It was discovered that, under certain circumstances,     glibc's getaddrinfo() function would send DNS queries     to random file descriptors. An attacker could     potentially use this flaw to send DNS queries to     unintended recipients, resulting in information     disclosure or data loss due to the application     encountering corrupted data.(CVE-2013-7423)

  - A buffer overflow flaw was found in the way glibc's     gethostbyname_r() and other related functions computed     the size of a buffer when passed a misaligned buffer as     input. An attacker able to make an application call any     of these functions with a misaligned buffer could use     this flaw to crash the application or, potentially,     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-1781)

  - The nss_dns implementation of getnetbyname in GNU C     Library (aka glibc) before 2.21, when the DNS backend     in the Name Service Switch configuration is enabled,     allows remote attackers to cause a denial of service     (infinite loop) by sending a positive answer while a     network name is being process.(CVE-2014-9402)

  - In the GNU C Library (aka glibc or libc6) through 2.29,     proceed_next_node in posix/regexec.c has a heap-based     buffer over-read via an attempted case-insensitive     regular-expression match.(CVE-2019-9169)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory.

    Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty     files. A local attacker could use this to gain administrative privileges or expose sensitive information.
    (CVE-2013-2207, CVE-2016-2856)

    Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not     properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite     loop). (CVE-2014-8121)

    Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions     returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service     (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

    Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly     account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2015-1781)

    Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C     Library did not handle long lines in the files databases correctly. A local attacker could use this to     cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

    Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-     range argument data. An attacker could use this to cause a denial of service (application crash) or     possibly expose sensitive information. (CVE-2015-8776)

    Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection     mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege     boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
    (CVE-2015-8777)

    Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size     argument, leading to an integer overflow. An attacker could use to cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2015-8778)

    Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C     Library when handling long catalog names. An attacker could use this to cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

    Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly     handle long names passed as arguments. An attacker could use to cause a denial of service (stack     exhaustion leading to an application crash). (CVE-2016-3075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This updates addresses a critical security vulnerability in the DNS resolver related to `AF_UNSPEC` queries with `getaddrinfo` (CVE-2015-7547). It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves `malloc` scalability for applications which start and terminate many threads. The output of `locale -a` is now ASCII-only (previously, it contained ISO-8859-1 characters).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc fixes the following issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

  - CVE-2013-2207: pt_chown tricked into granting access to     another users pseudo-terminal (bsc#830257)

  - CVE-2013-4458: Stack (frame) overflow in getaddrinfo()     when called with AF_INET6 (bsc#847227)

  - CVE-2014-8121: denial of service issue in the NSS     backends (bsc#918187)

  - bsc#920338: Read past end of pattern in fnmatch

  - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201602-02 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library:
      The Google Security Team and Red Hat discovered a stack-based buffer         overflow in the send_dg() and send_vc() functions due to a buffer         mismanagement when getaddrinfo() is called with AF_UNSPEC         (CVE-2015-7547).
      The strftime() function access invalid memory when passed         out-of-range data, resulting in a crash (CVE-2015-8776).
      An integer overflow was found in the __hcreate_r() function         (CVE-2015-8778).
      Multiple unbounded stack allocations were found in the catopen()         function (CVE-2015-8779).
    Please review the CVEs referenced below for additional vulnerabilities       that had already been fixed in previous versions of sys-libs/glibc, for       which we have not issued a GLSA before.
  Impact :

    A remote attacker could exploit any application which performs host name       resolution using getaddrinfo() in order to execute arbitrary code or       crash the application. The other vulnerabilities can possibly be       exploited to cause a Denial of Service or leak information.
  Workaround :

    A number of mitigating factors for CVE-2015-7547 have been identified.
      Please review the upstream advisory and references below.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Update fix for CVE-2015-7547 (#1296028).

  - Create helper threads with enough stack for POSIX AIO     and timers (#1301625).

  - Fix CVE-2015-7547: getaddrinfo stack-based buffer     overflow (#1296028).

  - Support loading more libraries with static TLS     (#1291270).

  - Check for NULL arena pointer in _int_pvalloc (#1256890).

  - Don't change no_dyn_threshold on mallopt failure     (#1256891).

  - Unlock main arena after allocation in calloc (#1256812).

  - Enable robust malloc change again (#1256812).

  - Fix perturbing in malloc on free and simply perturb_byte     (#1256812).

  - Don't fall back to mmap prematurely (#1256812).

  - The malloc deadlock avoidance support has been     temporarily removed since it triggers deadlocks in     certain applications (#1244002).

  - Fix ruserok check to reject, not skip, negative user     checks (#1217186).

  - Optimize ruserok function for large ~/.rhosts     (#1217186).

  - Fix crash in valloc due to the backtrace deadlock fix     (#1207236).

  - Fix buffer overflow in gethostbyname_r with misaligned     buffer (#1209376, CVE-2015-1781).

  - Avoid deadlock in malloc on backtrace (#1066724).

  - Support running applications that use Intel AVX-512     (#1195453).

  - Silence logging of record type mismatch for DNSSEC     records (#1088301).

  - Shrink heap on free when vm.overcommit_memory == 2     (#867679).

  - Enhance nscd to detect any configuration file changes     (#859965).

  - Fix __times handling of EFAULT when buf is NULL     (#1124204).

  - Fix memory leak with dlopen and thread-local storage     variables (#978098).

  - Prevent getaddrinfo from writing DNS queries to random     fd (CVE-2013-7423, - Implement userspace half of in6.h     header coordination (#1053178).

  - Correctely size relocation cache used by profiler     (#1144132).

  - Fix reuse of cached stack leading to bounds overrun of     DTV (#1116050).

  - Return failure in getnetgrent only when all netgroups     have been searched (#1085312).

  - Fix valgrind warning in nscd_stats (#1091915).

  - Initialize xports array (#1159167).

  - Fix tst-default-attr test to not fail on powerpc     (#1023306).

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183534).

  - Fix typo in nscd/selinux.c (#1125307).

  - Actually run test-iconv modules (#1176907).

  - Fix recursive dlopen (#1154563).

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, #1172044).

  - Fix wordexp to honour WRDE_NOCMD (CVE-2014-7817,     #1171296).

  - Fix typo in res_send and res_query (#rh1138769).

Several vulnerabilities have been fixed in the GNU C Library, eglibc.

The CVE-2015-7547 vulnerability listed below is considered to have critical impact.

  - CVE-2014-8121     Robin Hack discovered that the nss_files database did     not correctly implement enumeration interleaved with     name-based or ID-based lookups. This could cause the     enumeration enter an endless loop, leading to a denial     of service.

  - CVE-2015-1781     Arjun Shankar discovered that the _r variants of host     name resolution functions (like gethostbyname_r), when     performing DNS name resolution, suffered from a buffer     overflow if a misaligned buffer was supplied by the     applications, leading to a crash or, potentially,     arbitrary code execution. Most applications are not     affected by this vulnerability because they use aligned     buffers.

  - CVE-2015-7547     The Google Security Team and Red Hat discovered that the     eglibc host name resolver function, getaddrinfo, when     processing AF_UNSPEC queries (for dual A/AAAA lookups),     could mismanage its internal buffers, leading to a     stack-based buffer overflow and arbitrary code     execution. This vulnerability affects most applications     which perform host name resolution using getaddrinfo,     including system services.

  - CVE-2015-8776     Adam Nielsen discovered that if an invalid separated     time value is passed to strftime, the strftime function     could crash or leak information. Applications normally     pass only valid time information to strftime; no     affected applications are known.

  - CVE-2015-8777     Hector Marco-Gisbert reported that LD_POINTER_GUARD was     not ignored for SUID programs, enabling an unintended     bypass of a security feature. This update causes eglibc     to always ignore the LD_POINTER_GUARD environment     variable.

  - CVE-2015-8778     Szabolcs Nagy reported that the rarely-used hcreate and     hcreate_r functions did not check the size argument     properly, leading to a crash (denial of service) for     certain arguments. No impacted applications are known at     this time.

  - CVE-2015-8779     The catopen function contains several unbound stack     allocations (stack overflows), causing it the crash the     process (denial of service). No applications where this     issue has a security impact are currently known.

The following fixed vulnerabilities currently lack CVE assignment :

  - Joseph Myers reported that an integer overflow in the     strxfrm can lead to heap-based buffer overflow, possibly     allowing arbitrary code execution. In addition, a     fallback path in strxfrm uses an unbounded stack     allocation (stack overflow), leading to a crash or     erroneous application behavior.
  - Kostya Serebryany reported that the fnmatch function     could skip over the terminating NUL character of a     malformed pattern, causing an application calling     fnmatch to crash (denial of service).

  - Joseph Myers reported that the IO_wstr_overflow     function, internally used by wide-oriented character     streams, suffered from an integer overflow, leading to a     heap-based buffer overflow. On GNU/Linux systems,     wide-oriented character streams are rarely used, and no     affected applications are known.

  - Andreas Schwab reported a memory leak (memory allocation     without a matching deallocation) while processing     certain DNS answers in getaddrinfo, related to the
    _nss_dns_gethostbyname4_r function. This vulnerability     could lead to a denial of service.

While it is only necessary to ensure that all processes are not using the old eglibc anymore, it is recommended to reboot the machines after applying the security upgrade.

Updated glibc packages that fix multiple security issues are now available for Red Hat Enterprise Linux 7.1 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

It was discovered that the nss_files backend for the Name Service Switch in glibc would return incorrect data to applications or corrupt the heap (depending on adjacent heap contents). A local attacker could potentially use this flaw to execute arbitrary code on the system.
(CVE-2015-5277)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

A heap-based buffer overflow flaw and a stack overflow flaw were found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use these flaws to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1472, CVE-2015-1473)

The CVE-2015-5277 issue was discovered by Sumit Bose and Lukas Slebodnik of Red Hat, and the CVE-2015-1781 issue was discovered by Arjun Shankar of Red Hat.

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

A heap-based buffer overflow flaw and a stack overflow flaw were found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use these flaws to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1472, CVE-2015-1473)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in glibc's _IO_wstr_overflow() function. An attacker able to make an application call this function could use this flaw to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application.

A flaw was found in the way glibc's fnmatch() function processed certain malformed patterns. An attacker able to make an application call this function could use this flaw to crash that application.

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

It was discovered that the nss_files backend for the Name Service Switch in glibc would return incorrect data to applications or corrupt the heap (depending on adjacent heap contents). A local attacker could potentially use this flaw to execute arbitrary code on the system.
(CVE-2015-5277)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A stack overflow flaw was found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use this flaw to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1473)

A heap-based buffer overflow flaw was found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use this flaw to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1472)

Updated glibc packages that fix multiple security issues, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

A heap-based buffer overflow flaw and a stack overflow flaw were found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use these flaws to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1472, CVE-2015-1473)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in glibc's _IO_wstr_overflow() function. An attacker able to make an application call this function could use this flaw to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (BZ#1195762)

A flaw was found in the way glibc's fnmatch() function processed certain malformed patterns. An attacker able to make an application call this function could use this flaw to crash that application.
(BZ#1197730)

The CVE-2015-1781 issue was discovered by Arjun Shankar of Red Hat.

These updated glibc packages also include numerous bug fixes and one enhancement. Space precludes documenting all of these changes in this advisory. For information on the most significant of these changes, users are directed to the following article on the Red Hat Customer Portal :

https://access.redhat.com/articles/2050743

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2199 advisory.

    - Backport fixes for various security flaws (#1209107):
      - Prevent heap buffer overflow in swscanf (CVE-2015-1472, CVE-2015-1473,
          - Prevent integer overflow in _IO_wstr_overflow (#1195762).
      - Prevent potential denial of service in internal_fnmatch (#1197730).
      - Prevent buffer overflow in gethostbyname_r and related functions         with misaligned buffer (CVE-2015-1781, #1199525).
    - Fix invalid file descriptor reuse when sending DNS query       (CVE-2013-7423, #1194143).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2199 advisory.

  - glibc: getaddrinfo() writes DNS queries to random file descriptors under high load (CVE-2013-7423)

  - glibc: heap buffer overflow in glibc swscanf (CVE-2015-1472)

  - glibc: Stack-overflow in glibc swscanf (CVE-2015-1473)

  - glibc: buffer overflow in gethostbyname_r() and related functions with misaligned buffer (CVE-2015-1781)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

glibc was updated to fix bugs and security issues.

Security issues fixed :

  - A buffer overflow in nss_dns was fixed that could lead     to crashes. (CVE-2015-1781, bsc#927080, BZ #18287)

  - A denial of service attack (out of memory) in the NSS     files backend was fixed (CVE-2014-8121, bsc#918187,     GLIBC BZ #18007)

Non security bugs fixed :

  - Fix regression in threaded application malloc     performance (bsc#915955, GLIBC#17195)

  - Fix read past end of pattern in fnmatch (bsc#920338,     GLIBC#17062, GLIBC#18032, GLIBC#18036)

  - Record TTL also for DNS PTR queries (bsc#928723,     GLIBC#18513)

  - Increase MINSIGSTKSZ and SIGSTKSZ for aarch64     (bsc#931480, GLIBC#16850)

  - Fix handling of IPv6 nameservers (bsc#939211,     GLIBC#13028, GLIBC#17053)

  - Avoid use of asm/ptrace.h (bsc#934084)

  - Do not corrupt the top of a threaded heap if top chunk     is MINSIZE (GLIBC#18502)

  - Terminate unwinding after makecontext_ret on s390     (bsc#940332. bsc#944494, GLIBC#18508)

  - Restore signal mask in set/swapcontext on s390     (bsc#940195, bsc#944494, GLIBC#18080)

  - fix dlopen in static binaries (bsc#937853, GLIBC#17250)

  - Properly reread entry after failure in nss_files getent     function (bsc#945779, BZ #18991)

Features added :

  - AVX512 support (fate#318844)

  - Add compatibility symlinks for LSB 3.0 (fate#318933)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc provides fixes for security and non-security issues.

These security issues have been fixed :

  - CVE-2015-1781: Buffer length after padding in     resolv/nss_dns/dns-host.c. (bsc#927080)

  - CVE-2013-2207: pt_chown did not properly check     permissions for tty files, which allowed local users to     change the permission on the files and obtain access to     arbitrary pseudo-terminals by leveraging a FUSE file     system. (bsc#830257)

  - CVE-2014-8121: DB_LOOKUP in the Name Service Switch     (NSS) did not properly check if a file is open, which     allowed remote attackers to cause a denial of service     (infinite loop) by performing a look-up while the     database is iterated over the database, which triggers     the file pointer to be reset. (bsc#918187)

  - Fix read past end of pattern in fnmatch. (bsc#920338)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc was updated to fix security issues and bugs :

  - Separate internal state between getXXent and getXXbyYY     NSS calls (CVE-2014-8121, bsc#918187, BZ #18007)

  - Fix read past end of pattern in fnmatch (bsc#920338, BZ     #17062, BZ #18032, BZ #18036)

  - Fix buffer overflow in nss_dns (CVE-2015-1781,     bsc#927080, BZ #18287)

Also this bug got fixed :

  - Simplify handling of nameserver configuration in     resolver (bsc#917539)

Arjun Shankar of Red Hat discovered that gethostbyname_r and related functions compute the size of an input buffer incorrectly if the passed-in buffer is misaligned. This results in a buffer overflow.

For the oldoldstable distribution (squeeze), this problem has been fixed in version 2.11.3-4+deb6u6.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in glibc :

It was discovered that, under certain circumstances, glibc's getaddrinfo\(\) function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data (CVE-2013-7423).

A buffer overflow flaw was found in the way glibc's gethostbyname_r\(\) and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application (CVE-2015-1781).

The updated packages provides a solution for these security issues.

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

This update also fixes the following bug :

  - Previously, the nscd daemon did not properly reload     modified data when the user edited monitored nscd     configuration files. As a consequence, nscd returned     stale data to system processes. This update adds a     system of inotify-based monitoring and stat-based backup     monitoring for nscd configuration files. As a result,     nscd now detects changes to its configuration files and     reloads the data properly, which prevents it from     returning stale data.

Updated glibc packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

The CVE-2015-1781 issue was discovered by Arjun Shankar of Red Hat.

This update also fixes the following bug :

* Previously, the nscd daemon did not properly reload modified data when the user edited monitored nscd configuration files. As a consequence, nscd returned stale data to system processes. This update adds a system of inotify-based monitoring and stat-based backup monitoring for nscd configuration files. As a result, nscd now detects changes to its configuration files and reloads the data properly, which prevents it from returning stale data. (BZ#1194149)

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix invalid file descriptor reuse while sending DNS     query (#1207995, CVE-2013-7423).

  - Fix buffer overflow in gethostbyname_r with misaligned     buffer (#1209375, CVE-2015-1781).

  - Enhance nscd to detect any configuration file changes     (#1194149).

From Red Hat Security Advisory 2015:0863 :

Updated glibc packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

The CVE-2015-1781 issue was discovered by Arjun Shankar of Red Hat.

This update also fixes the following bug :

* Previously, the nscd daemon did not properly reload modified data when the user edited monitored nscd configuration files. As a consequence, nscd returned stale data to system processes. This update adds a system of inotify-based monitoring and stat-based backup monitoring for nscd configuration files. As a result, nscd now detects changes to its configuration files and reloads the data properly, which prevents it from returning stale data. (BZ#1194149)

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

ID	Name	Product	Family	Severity
199014	RHEL 5 : glibc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
125005	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1552)	Nessus	Huawei Local Security Checks	critical
91334	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	critical
89473	Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)	Nessus	Fedora Local Security Checks	high
88831	SUSE SLES11 Security Update : glibc (SUSE-SU-2016:0470-1)	Nessus	SuSE Local Security Checks	critical
88822	GLSA-201602-02 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
88783	OracleVM 3.3 : glibc (OVMSA-2016-0013) (GHOST)	Nessus	OracleVM Local Security Checks	high
88767	Debian DSA-3480-1 : eglibc - security update	Nessus	Debian Local Security Checks	critical
88573	RHEL 7 : glibc (RHSA-2015:2589)	Nessus	Red Hat Local Security Checks	high
87556	Scientific Linux Security Update : glibc on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	high
87343	Amazon Linux AMI : glibc (ALAS-2015-617)	Nessus	Amazon Linux Local Security Checks	high
87142	CentOS 7 : glibc (CESA-2015:2199)	Nessus	CentOS Local Security Checks	high
87092	Oracle Linux 7 : glibc (ELSA-2015-2199)	Nessus	Oracle Linux Local Security Checks	critical
86937	RHEL 7 : glibc (RHSA-2015:2199)	Nessus	Red Hat Local Security Checks	high
86696	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2015:1844-1)	Nessus	SuSE Local Security Checks	medium
85624	SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2015:1424-1)	Nessus	SuSE Local Security Checks	medium
83867	openSUSE Security Update : glibc / glibc-testsuite / glibc-utils / etc (openSUSE-2015-383)	Nessus	SuSE Local Security Checks	medium
83865	Debian DLA-230-1 : eglibc security update	Nessus	Debian Local Security Checks	medium
83170	Mandriva Linux Security Advisory : glibc (MDVSA-2015:218)	Nessus	Mandriva Local Security Checks	medium
83056	Amazon Linux AMI : glibc (ALAS-2015-513)	Nessus	Amazon Linux Local Security Checks	medium
82987	Scientific Linux Security Update : glibc on SL6.x i386/x86_64 (20150421)	Nessus	Scientific Linux Local Security Checks	medium
82984	RHEL 6 : glibc (RHSA-2015:0863)	Nessus	Red Hat Local Security Checks	medium
82983	OracleVM 3.3 : glibc (OVMSA-2015-0055)	Nessus	OracleVM Local Security Checks	medium
82980	Oracle Linux 6 : glibc (ELSA-2015-0863)	Nessus	Oracle Linux Local Security Checks	medium
82928	CentOS 6 : glibc (CESA-2015:0863)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2015-1781

critical

Tenable Plugins

critical

critical

critical

high

critical

critical

high

critical

high

high

high

high

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium