Detections
Analytics

Fedora 39 : glibc (2024-df41d584d0)

high Nessus Plugin ID 209838

Language:

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-df41d584d0 advisory.

 Auto-sync with upstream branch release/2.38/master

 - Add BuildRequires:gzip for compressed character maps and info files.

 Upstream commit: 4dd8641461463b667b5503ab0ea4abcf261378a9

 - Add crt1-2.0.o for glibc 2.0 compatibility tests
 - libio: Attempt wide backup free only for non-legacy code
 - nptl: Use <support/check.h> facilities in tst-setuid3
 - posix: Use <support/check.h> facilities in tst-truncate and tst-truncate64
 - ungetc: Fix backup buffer leak on program exit [BZ #27821]
 - ungetc: Fix uninitialized read when putting into unused streams [BZ #27821]
 - Make tst-ungetc use libsupport
 - stdio-common: Add test for vfscanf with matches longer than INT_MAX [BZ #27650]
 - support: Add FAIL test failure helper
 - x86: Fix bug in strchrnul-evex512 [BZ #32078]
 - Fix name space violation in fortify wrappers (bug 32052)
 - resolv: Fix tst-resolv-short-response for older GCC (bug 32042)
 - Update syscall lists for Linux 6.5
 - Add mremap tests
 - mremap: Update manual entry
 - linux: Update the mremap C implementation [BZ #31968]
 - resolv: Track single-request fallback via _res._flags (bug 31476)
 - resolv: Do not wait for non-existing second DNS response after error (bug 30081)
 - resolv: Allow short error responses to match any query (bug 31890)
 - Linux: Make __rseq_size useful for feature detection (bug 31965)
 - elf: Make dl-rseq-symbols Linux only
 - nptl: fix potential merge of __rseq_* relro symbols
 - s390x: Fix segfault in wcsncmp [BZ #31934]
 - misc: Add support for Linux uio.h RWF_NOAPPEND flag
 - i386: Disable Intel Xeon Phi tests for GCC 15 and above (BZ 31782)
 - Force DT_RPATH for --enable-hardcoded-path-in-tests
 - resolv: Fix some unaligned accesses in resolver [BZ #30750]
 - nscd: Use time_t for return type of addgetnetgrentX
 - elf: Also compile dl-misc.os with $(rtld-early-cflags)
 - CVE-2024-33601, CVE-2024-33602: nscd: netgroup: Use two buffers in addgetnetgrentX (bug 31680)
 - CVE-2024-33600: nscd: Avoid null pointer crashes after notfound response (bug 31678)
 - CVE-2024-33600: nscd: Do not send missing not-found response in addgetnetgrentX (bug 31678)
 - CVE-2024-33599: nscd: Stack-based buffer overflow in netgroup cache (bug 31677)
 - i386: ulp update for SSE2 --disable-multi-arch configurations
 - nptl: Fix tst-cancel30 on kernels without ppoll_time64 support
 - login: structs utmp, utmpx, lastlog _TIME_BITS independence (bug 30701)
 - login: Check default sizes of structs utmp, utmpx, lastlog
 - sparc: Remove 64 bit check on sparc32 wordsize (BZ 27574)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected glibc package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2024-df41d584d0

Plugin Details

Severity: High

ID: 209838

File Name: fedora_2024-df41d584d0.nasl

Version: 1.1

Type: local

Agent: unix

Published: 10/28/2024

Updated: 10/28/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.7

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:P/A:P

CVSS Score Source: CVE-2024-33602

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:glibc, cpe:/o:fedoraproject:fedora:39

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/11/2024

Vulnerability Publication Date: 5/6/2024

Reference Information

CVE: CVE-2024-33599, CVE-2024-33600, CVE-2024-33601, CVE-2024-33602