The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0769 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread     libraries (libpthread), standard math libraries (libm), and the Name Server     Caching Daemon (nscd) used by multiple programs on the system. Without     these libraries, the Linux system cannot function correctly.

    It was found that getaddrinfo() did not limit the amount of stack memory     used during name resolution. An attacker able to make an application     resolve an attacker-controlled hostname or IP address could possibly cause     the application to exhaust all stack memory and crash. (CVE-2013-1914)

    A flaw was found in the regular expression matching routines that process     multibyte character input. If an application utilized the glibc regular     expression matching mechanism, an attacker could provide specially-crafted     input that, when processed, would cause the application to crash.
    (CVE-2013-0242)

    This update also fixes the following bugs:

    * The improvements RHSA-2012:1207 made to the accuracy of floating point     functions in the math library caused performance regressions for those     functions. The performance regressions were analyzed and a fix was applied     that retains the current accuracy but reduces the performance penalty to     acceptable levels. Refer to Red Hat Knowledge solution 229993, linked     to in the References, for further information. (BZ#950535)

    * It was possible that a memory location freed by the localization code     could be accessed immediately after, resulting in a crash. The fix ensures     that the application does not crash by avoiding the invalid memory access.
    (BZ#951493)

    Users of glibc are advised to upgrade to these updated packages, which     contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 5 : glibc (RHSA-2013:0769)

high Nessus Plugin ID 66211

Version 1.17