Detections
Analytics

Amazon Linux AMI : glibc (ALAS-2015-473)

high Nessus Plugin ID 81024

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

A heap-based buffer overflow was found in glibc's
__nss_hostname_digits_dots() function, which is used by the gethostbyname() and gethostbyname2() glibc function calls. A remote attacker able to make an application call to either of these functions can use this flaw to execute arbitrary code with the permissions of the user running the application.

Special notes :

Because of the exceptional nature of this security event, we have backfilled our 2014.03 and 2013.09 Amazon Linux AMI repositories with new glibc packages that fix CVE-2015-0235 .

For 2014.09 Amazon Linux AMIs, 'glibc-2.17-55.93.amzn1' addresses the CVE. Running 'yum clean all' followed by 'yum update glibc' will install the fixed package, and you should reboot your instance after installing the update.

For Amazon Linux AMIs 'locked' to the 2014.03 repositories, the same 'glibc-2.17-55.93.amzn1' addresses the CVE. Running 'yum clean all' followed by 'yum update glibc' will install the fixed package, and you should reboot your instance after installing the update.

For Amazon Linux AMIs 'locked' to the 2013.09 repositories, 'glibc-2.12-1.149.49.amzn1' addresses the CVE. Running 'yum clean all' followed by 'yum update glibc' will install the fixed package, and you should reboot your instance after installing the update.

For Amazon Linux AMIs 'locked' to the 2013.03, 2012.09, 2012.03, or 2011.09 repositories, run 'yum clean all' followed by 'yum
--releasever=2013.09 update glibc' to install the updated glibc package. You should reboot your instance after installing the update.

If you are using a pre-2011.09 Amazon Linux AMI, then you are using a version of the Amazon Linux AMI that was part of our public beta, and we encourage you to move to a newer version of the Amazon Linux AMI as soon as possible.

Solution

Run 'yum update glibc' to update your system. Note that you may need to run 'yum clean all' first. Once this update has been applied, 'reboot your instance to ensure that all processes and daemons that link against glibc are using the updated version'. On new instance launches, you should still reboot after cloud-init has automatically applied this update.

See Also

https://alas.aws.amazon.com/ALAS-2015-473.html

Plugin Details

Severity: High

ID: 81024

File Name: ala_ALAS-2015-473.nasl

Version: 1.17

Type: local

Agent: unix

Published: 1/27/2015

Updated: 6/27/2018

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:glibc-static, p-cpe:/a:amazon:linux:glibc-devel, p-cpe:/a:amazon:linux:glibc-common, p-cpe:/a:amazon:linux:glibc, p-cpe:/a:amazon:linux:glibc-utils, p-cpe:/a:amazon:linux:glibc-debuginfo, p-cpe:/a:amazon:linux:glibc-headers, p-cpe:/a:amazon:linux:glibc-debuginfo-common, cpe:/o:amazon:linux, p-cpe:/a:amazon:linux:nscd

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/27/2015

Exploitable With

Core Impact

Metasploit (Exim GHOST (glibc gethostbyname) Buffer Overflow)

Reference Information

CVE: CVE-2015-0235

BID: 72325

ALAS: 2015-473

CERT: 967332