Detections
Analytics
Debian DSA-3887-1 : glibc - security update (Stack Clash)
high Nessus Plugin ID 100878
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
The Qualys Research Labs discovered various problems in the dynamic linker of the GNU C Library which allow local privilege escalation by clashing the stack. For the full details, please refer to their advisory published at:https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
Solution
Upgrade the glibc packages.For the oldstable distribution (jessie), this problem has been fixed in version 2.19-18+deb8u10.
For the stable distribution (stretch), this problem has been fixed in version 2.24-11+deb9u1.
See Also
https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
https://packages.debian.org/source/jessie/glibc
Plugin Details
Severity: High
ID: 100878
File Name: debian_DSA-3887.nasl
Version: 3.10
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 6/20/2017
Updated: 1/4/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: High
Base Score: 7.2
Temporal Score: 5.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 7
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:glibc, cpe:/o:debian:debian_linux:8.0, cpe:/o:debian:debian_linux:9.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/19/2017
Vulnerability Publication Date: 6/19/2017
Reference Information
CVE: CVE-2017-1000366
DSA: 3887