Detections
Analytics

GLSA-200408-16 : glibc: Information leak with LD_DEBUG

low Nessus Plugin ID 14572

Synopsis

The remote Gentoo host is missing one or more security-related patches.

Description

The remote host is affected by the vulnerability described in GLSA-200408-16 (glibc: Information leak with LD_DEBUG)

 Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information.
 Impact :

 An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precendence over those symbols to gain information or perform further exploitation.
 Workaround :

 There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of glibc.

Solution

All glibc users should upgrade to the latest version:
 # emerge sync # emerge -pv your_version # emerge your_version

See Also

https://security.gentoo.org/glsa/200408-16

Plugin Details

Severity: Low

ID: 14572

File Name: gentoo_GLSA-200408-16.nasl

Version: 1.16

Type: local

Published: 8/30/2004

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Low

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:glibc, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list, Host/Gentoo/arch

Patch Publication Date: 8/16/2004

Vulnerability Publication Date: 8/16/2004

Reference Information

CVE: CVE-2004-1453

GLSA: 200408-16