A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - On the x86-64 architecture, the GNU C Library (aka     glibc) before 2.31 fails to ignore the     LD_PREFER_MAP_32BIT_EXEC environment variable during     program execution after a security transition, allowing     local attackers to restrict the possible mapping     addresses for loaded libraries and thus bypass ASLR for     a setuid program.(CVE-2019-19126)

  - The iconv feature in the GNU C Library (aka glibc or     libc6) through 2.32, when processing invalid multi-byte     input sequences in the EUC-KR encoding, may have a     buffer over-read.(CVE-2019-25013)

  - A buffer overflow in glibc 2.5 (released on September     29, 2006) and can be triggered through the     LD_LIBRARY_PATH environment variable. Please note that     many versions of glibc are not vulnerable to this issue     if patched for CVE-2017-1000366.(CVE-2017-1000409)

  - A memory leak in glibc 2.1.1 (released on May 24, 1999)     can be reached and amplified through the LD_HWCAP_MASK     environment variable. Please note that many versions of     glibc are not vulnerable to this issue if patched for     CVE-2017-1000366.(CVE-2017-1000408)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

  - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the     LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000408)

  - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the     LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000409)

  - Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2017-14062)

  - The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~     operator followed by a long string. (CVE-2017-15670)

  - The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer     overflow during unescaping of user names with the ~ operator. (CVE-2017-15804)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to     a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code     path that lacks an integer overflow check. (CVE-2017-17426)

  - An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S     in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping     memory check if the source memory range spans the middle of the address space, resulting in corrupt data     being produced by the copy operation. This may disclose information to context-dependent attackers, or     result in a denial of service, or, possibly, code execution. (CVE-2017-18269)

  - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer underflow and potential code execution.
    (CVE-2018-1000001)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via     getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the     if_nametoindex() function. (CVE-2018-19591)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3534-1 advisory.

    It was discovered that the GNU C library did not properly handle all of the possible return values from     the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in     setuid programs and gain administrative privileges. (CVE-2018-1000001)

    A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local     attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment     variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink     protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

    A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic     loader. A local attacker could potentially exploit this with a specially crafted value in the     LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a     system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

    An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob()     implementation. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

    A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU     C library glob() implementation. An attacker could potentially exploit this to cause a denial of service     or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

    It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN     for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by     providing a specially crafted library in the current working directory in order to gain administrative     privileges. (CVE-2017-16997)

    It was discovered that the GNU C library malloc() implementation could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-     based overflow. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

  - A privilege escalation bug in the realpath() function     has been fixed. [CVE-2018-1000001, bsc#1074293]

  - A memory leak and a buffer overflow in the dynamic ELF     loader has been fixed. [CVE-2017-1000408,     CVE-2017-1000409, bsc#1071319]

  - An issue in the code handling RPATHs was fixed that     could have been exploited by an attacker to execute code     loaded from arbitrary libraries. [CVE-2017-16997,     bsc#1073231]

  - A potential crash caused by a use-after-free bug in     pthread_create() has been fixed. [bsc#1053188]

  - A bug that prevented users to build shared objects which     use the optimized libmvec.so API has been fixed.
    [bsc#1070905]

  - A memory leak in the glob() function has been fixed.
    [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804,     bsc#1064569, bsc#1064580, bsc#1064583]

  - A bug that would lose the syscall error code value in     case of crashes has been fixed. [bsc#1063675]

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for glibc fixes the following issues :

  - A privilege escalation bug in the realpath() function     has been fixed. [CVE-2018-1000001, bsc#1074293]

  - A memory leak and a buffer overflow in the dynamic ELF     loader has been fixed. [CVE-2017-1000408,     CVE-2017-1000409, bsc#1071319]

  - An issue in the code handling RPATHs was fixed that     could have been exploited by an attacker to execute code     loaded from arbitrary libraries. [CVE-2017-16997,     bsc#1073231]

  - A potential crash caused by a use-after-free bug in     pthread_create() has been fixed. [bsc#1053188]

  - A bug that prevented users to build shared objects which     use the optimized libmvec.so API has been fixed.
    [bsc#1070905]

  - A memory leak in the glob() function has been fixed.
    [CVE-2017-15670, CVE-2017-15671, CVE-2017-15804,     bsc#1064569, bsc#1064580, bsc#1064583]

  - A bug that would lose the syscall error code value in     case of crashes has been fixed. [bsc#1063675]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update addresses RHBZ#1468837, which caused bash to lack job control in mock chroots. (Note that glibc inside the chroot needs to be upgraded for the fix to be effective.)

In additon, two dynamic linker issues where fixed which are not security bugs, but received CVE IDs nevertheless (RHBZ#1524867, CVE-2017-1000408, CVE-2017-1000409).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
147607	EulerOS Virtualization 3.0.2.6 : glibc (EulerOS-SA-2021-1412)	Nessus	Huawei Local Security Checks	high
147282	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	critical
106134	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3534-1)	Nessus	Ubuntu Local Security Checks	critical
106059	openSUSE Security Update : glibc (openSUSE-2018-30)	Nessus	SuSE Local Security Checks	critical
106044	SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0074-1)	Nessus	SuSE Local Security Checks	critical
105918	Fedora 27 : glibc (2017-828f8a8fc6)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-1000409

high

Tenable Plugins

high

critical

critical

critical

critical

high