ID

VAR-201706-0334

CVE

CVE-2017-1000366

TITLE

glibc Buffer error vulnerability

DESCRIPTION

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier. glibc Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: glibc security update Advisory ID: RHSA-2017:1479-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:1479 Issue date: 2017-06-19 CVE Names: CVE-2017-1000366 ===================================================================== 1. Summary: An update for glibc is now available for Red Hat Enterprise Linux 5 Extended Lifecycle Support, Red Hat Enterprise Linux 5.9 Long Life, Red Hat Enterprise Linux 6.2 Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.5 Telco Extended Update Support, Red Hat Enterprise Linux 6.6 Advanced Update Support, Red Hat Enterprise Linux 6.6 Telco Extended Update Support, Red Hat Enterprise Linux 6.7 Extended Update Support, and Red Hat Enterprise Linux 7.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode EUS (v. 7.2) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) - x86_64 Red Hat Enterprise Linux HPC Node EUS (v. 6.7) - x86_64 Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7) - x86_64 Red Hat Enterprise Linux Long Life (v. 5.9 server) - i386, ia64, x86_64 Red Hat Enterprise Linux Server (v. 5 ELS) - i386, s390x, x86_64 Red Hat Enterprise Linux Server AUS (v. 6.2) - x86_64 Red Hat Enterprise Linux Server AUS (v. 6.4) - x86_64 Red Hat Enterprise Linux Server AUS (v. 6.5) - x86_64 Red Hat Enterprise Linux Server AUS (v. 6.6) - x86_64 Red Hat Enterprise Linux Server EUS (v. 6.7) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server EUS (v. 7.2) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.2) - x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.4) - x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.5) - x86_64 Red Hat Enterprise Linux Server Optional AUS (v. 6.6) - x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 6.7) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.2) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 6.5) - x86_64 Red Hat Enterprise Linux Server Optional TUS (v. 6.6) - x86_64 Red Hat Enterprise Linux Server TUS (v. 6.5) - x86_64 Red Hat Enterprise Linux Server TUS (v. 6.6) - x86_64 3. Description: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap (or different memory region) and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult. (CVE-2017-1000366) Red Hat would like to thank Qualys Research Labs for reporting this issue. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the glibc library must be restarted, or the system rebooted. 5. Bugs fixed (https://bugzilla.redhat.com/): 1452543 - CVE-2017-1000366 glibc: heap/stack gap jumping via unbounded stack allocations 6. Package List: Red Hat Enterprise Linux Long Life (v. 5.9 server): Source: glibc-2.5-107.el5_9.9.src.rpm i386: glibc-2.5-107.el5_9.9.i386.rpm glibc-2.5-107.el5_9.9.i686.rpm glibc-common-2.5-107.el5_9.9.i386.rpm glibc-debuginfo-2.5-107.el5_9.9.i386.rpm glibc-debuginfo-2.5-107.el5_9.9.i686.rpm glibc-debuginfo-common-2.5-107.el5_9.9.i386.rpm glibc-devel-2.5-107.el5_9.9.i386.rpm glibc-headers-2.5-107.el5_9.9.i386.rpm glibc-utils-2.5-107.el5_9.9.i386.rpm nscd-2.5-107.el5_9.9.i386.rpm ia64: glibc-2.5-107.el5_9.9.i686.rpm glibc-2.5-107.el5_9.9.ia64.rpm glibc-common-2.5-107.el5_9.9.ia64.rpm glibc-debuginfo-2.5-107.el5_9.9.i686.rpm glibc-debuginfo-2.5-107.el5_9.9.ia64.rpm glibc-debuginfo-common-2.5-107.el5_9.9.i386.rpm glibc-devel-2.5-107.el5_9.9.ia64.rpm glibc-headers-2.5-107.el5_9.9.ia64.rpm glibc-utils-2.5-107.el5_9.9.ia64.rpm nscd-2.5-107.el5_9.9.ia64.rpm x86_64: glibc-2.5-107.el5_9.9.i686.rpm glibc-2.5-107.el5_9.9.x86_64.rpm glibc-common-2.5-107.el5_9.9.x86_64.rpm glibc-debuginfo-2.5-107.el5_9.9.i386.rpm glibc-debuginfo-2.5-107.el5_9.9.i686.rpm glibc-debuginfo-2.5-107.el5_9.9.x86_64.rpm glibc-debuginfo-common-2.5-107.el5_9.9.i386.rpm glibc-devel-2.5-107.el5_9.9.i386.rpm glibc-devel-2.5-107.el5_9.9.x86_64.rpm glibc-headers-2.5-107.el5_9.9.x86_64.rpm glibc-utils-2.5-107.el5_9.9.x86_64.rpm nscd-2.5-107.el5_9.9.x86_64.rpm Red Hat Enterprise Linux Server (v. 5 ELS): Source: glibc-2.5-123.el5_11.4.src.rpm i386: glibc-2.5-123.el5_11.4.i386.rpm glibc-2.5-123.el5_11.4.i686.rpm glibc-common-2.5-123.el5_11.4.i386.rpm glibc-debuginfo-2.5-123.el5_11.4.i386.rpm glibc-debuginfo-2.5-123.el5_11.4.i686.rpm glibc-debuginfo-common-2.5-123.el5_11.4.i386.rpm glibc-devel-2.5-123.el5_11.4.i386.rpm glibc-headers-2.5-123.el5_11.4.i386.rpm glibc-utils-2.5-123.el5_11.4.i386.rpm nscd-2.5-123.el5_11.4.i386.rpm s390x: glibc-2.5-123.el5_11.4.s390.rpm glibc-2.5-123.el5_11.4.s390x.rpm glibc-common-2.5-123.el5_11.4.s390x.rpm glibc-debuginfo-2.5-123.el5_11.4.s390.rpm glibc-debuginfo-2.5-123.el5_11.4.s390x.rpm glibc-devel-2.5-123.el5_11.4.s390.rpm glibc-devel-2.5-123.el5_11.4.s390x.rpm glibc-headers-2.5-123.el5_11.4.s390x.rpm glibc-utils-2.5-123.el5_11.4.s390x.rpm nscd-2.5-123.el5_11.4.s390x.rpm x86_64: glibc-2.5-123.el5_11.4.i686.rpm glibc-2.5-123.el5_11.4.x86_64.rpm glibc-common-2.5-123.el5_11.4.x86_64.rpm glibc-debuginfo-2.5-123.el5_11.4.i386.rpm glibc-debuginfo-2.5-123.el5_11.4.i686.rpm glibc-debuginfo-2.5-123.el5_11.4.x86_64.rpm glibc-debuginfo-common-2.5-123.el5_11.4.i386.rpm glibc-devel-2.5-123.el5_11.4.i386.rpm glibc-devel-2.5-123.el5_11.4.x86_64.rpm glibc-headers-2.5-123.el5_11.4.x86_64.rpm glibc-utils-2.5-123.el5_11.4.x86_64.rpm nscd-2.5-123.el5_11.4.x86_64.rpm Red Hat Enterprise Linux HPC Node EUS (v. 6.7): Source: glibc-2.12-1.166.el6_7.8.src.rpm x86_64: glibc-2.12-1.166.el6_7.8.i686.rpm glibc-2.12-1.166.el6_7.8.x86_64.rpm glibc-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-devel-2.12-1.166.el6_7.8.i686.rpm glibc-devel-2.12-1.166.el6_7.8.x86_64.rpm glibc-headers-2.12-1.166.el6_7.8.x86_64.rpm glibc-utils-2.12-1.166.el6_7.8.x86_64.rpm nscd-2.12-1.166.el6_7.8.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional EUS (v. 6.7): x86_64: glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-static-2.12-1.166.el6_7.8.i686.rpm glibc-static-2.12-1.166.el6_7.8.x86_64.rpm Red Hat Enterprise Linux Server AUS (v. 6.2): Source: glibc-2.12-1.47.el6_2.18.src.rpm x86_64: glibc-2.12-1.47.el6_2.18.i686.rpm glibc-2.12-1.47.el6_2.18.x86_64.rpm glibc-common-2.12-1.47.el6_2.18.x86_64.rpm glibc-debuginfo-2.12-1.47.el6_2.18.i686.rpm glibc-debuginfo-2.12-1.47.el6_2.18.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6_2.18.i686.rpm glibc-debuginfo-common-2.12-1.47.el6_2.18.x86_64.rpm glibc-devel-2.12-1.47.el6_2.18.i686.rpm glibc-devel-2.12-1.47.el6_2.18.x86_64.rpm glibc-headers-2.12-1.47.el6_2.18.x86_64.rpm glibc-utils-2.12-1.47.el6_2.18.x86_64.rpm nscd-2.12-1.47.el6_2.18.x86_64.rpm Red Hat Enterprise Linux Server AUS (v. 6.4): Source: glibc-2.12-1.107.el6_4.10.src.rpm x86_64: glibc-2.12-1.107.el6_4.10.i686.rpm glibc-2.12-1.107.el6_4.10.x86_64.rpm glibc-common-2.12-1.107.el6_4.10.x86_64.rpm glibc-debuginfo-2.12-1.107.el6_4.10.i686.rpm glibc-debuginfo-2.12-1.107.el6_4.10.x86_64.rpm glibc-debuginfo-common-2.12-1.107.el6_4.10.i686.rpm glibc-debuginfo-common-2.12-1.107.el6_4.10.x86_64.rpm glibc-devel-2.12-1.107.el6_4.10.i686.rpm glibc-devel-2.12-1.107.el6_4.10.x86_64.rpm glibc-headers-2.12-1.107.el6_4.10.x86_64.rpm glibc-utils-2.12-1.107.el6_4.10.x86_64.rpm nscd-2.12-1.107.el6_4.10.x86_64.rpm Red Hat Enterprise Linux Server AUS (v. 6.5): Source: glibc-2.12-1.132.el6_5.9.src.rpm x86_64: glibc-2.12-1.132.el6_5.9.i686.rpm glibc-2.12-1.132.el6_5.9.x86_64.rpm glibc-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-devel-2.12-1.132.el6_5.9.i686.rpm glibc-devel-2.12-1.132.el6_5.9.x86_64.rpm glibc-headers-2.12-1.132.el6_5.9.x86_64.rpm glibc-utils-2.12-1.132.el6_5.9.x86_64.rpm nscd-2.12-1.132.el6_5.9.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 6.5): Source: glibc-2.12-1.132.el6_5.9.src.rpm x86_64: glibc-2.12-1.132.el6_5.9.i686.rpm glibc-2.12-1.132.el6_5.9.x86_64.rpm glibc-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-devel-2.12-1.132.el6_5.9.i686.rpm glibc-devel-2.12-1.132.el6_5.9.x86_64.rpm glibc-headers-2.12-1.132.el6_5.9.x86_64.rpm glibc-utils-2.12-1.132.el6_5.9.x86_64.rpm nscd-2.12-1.132.el6_5.9.x86_64.rpm Red Hat Enterprise Linux Server AUS (v. 6.6): Source: glibc-2.12-1.149.el6_6.12.src.rpm x86_64: glibc-2.12-1.149.el6_6.12.i686.rpm glibc-2.12-1.149.el6_6.12.x86_64.rpm glibc-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-devel-2.12-1.149.el6_6.12.i686.rpm glibc-devel-2.12-1.149.el6_6.12.x86_64.rpm glibc-headers-2.12-1.149.el6_6.12.x86_64.rpm glibc-utils-2.12-1.149.el6_6.12.x86_64.rpm nscd-2.12-1.149.el6_6.12.x86_64.rpm Red Hat Enterprise Linux Server TUS (v. 6.6): Source: glibc-2.12-1.149.el6_6.12.src.rpm x86_64: glibc-2.12-1.149.el6_6.12.i686.rpm glibc-2.12-1.149.el6_6.12.x86_64.rpm glibc-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-devel-2.12-1.149.el6_6.12.i686.rpm glibc-devel-2.12-1.149.el6_6.12.x86_64.rpm glibc-headers-2.12-1.149.el6_6.12.x86_64.rpm glibc-utils-2.12-1.149.el6_6.12.x86_64.rpm nscd-2.12-1.149.el6_6.12.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 6.7): Source: glibc-2.12-1.166.el6_7.8.src.rpm i386: glibc-2.12-1.166.el6_7.8.i686.rpm glibc-common-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-devel-2.12-1.166.el6_7.8.i686.rpm glibc-headers-2.12-1.166.el6_7.8.i686.rpm glibc-utils-2.12-1.166.el6_7.8.i686.rpm nscd-2.12-1.166.el6_7.8.i686.rpm ppc64: glibc-2.12-1.166.el6_7.8.ppc.rpm glibc-2.12-1.166.el6_7.8.ppc64.rpm glibc-common-2.12-1.166.el6_7.8.ppc64.rpm glibc-debuginfo-2.12-1.166.el6_7.8.ppc.rpm glibc-debuginfo-2.12-1.166.el6_7.8.ppc64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.ppc.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.ppc64.rpm glibc-devel-2.12-1.166.el6_7.8.ppc.rpm glibc-devel-2.12-1.166.el6_7.8.ppc64.rpm glibc-headers-2.12-1.166.el6_7.8.ppc64.rpm glibc-utils-2.12-1.166.el6_7.8.ppc64.rpm nscd-2.12-1.166.el6_7.8.ppc64.rpm s390x: glibc-2.12-1.166.el6_7.8.s390.rpm glibc-2.12-1.166.el6_7.8.s390x.rpm glibc-common-2.12-1.166.el6_7.8.s390x.rpm glibc-debuginfo-2.12-1.166.el6_7.8.s390.rpm glibc-debuginfo-2.12-1.166.el6_7.8.s390x.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.s390.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.s390x.rpm glibc-devel-2.12-1.166.el6_7.8.s390.rpm glibc-devel-2.12-1.166.el6_7.8.s390x.rpm glibc-headers-2.12-1.166.el6_7.8.s390x.rpm glibc-utils-2.12-1.166.el6_7.8.s390x.rpm nscd-2.12-1.166.el6_7.8.s390x.rpm x86_64: glibc-2.12-1.166.el6_7.8.i686.rpm glibc-2.12-1.166.el6_7.8.x86_64.rpm glibc-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-devel-2.12-1.166.el6_7.8.i686.rpm glibc-devel-2.12-1.166.el6_7.8.x86_64.rpm glibc-headers-2.12-1.166.el6_7.8.x86_64.rpm glibc-utils-2.12-1.166.el6_7.8.x86_64.rpm nscd-2.12-1.166.el6_7.8.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.2): Source: glibc-2.12-1.47.el6_2.18.src.rpm x86_64: glibc-debuginfo-2.12-1.47.el6_2.18.i686.rpm glibc-debuginfo-2.12-1.47.el6_2.18.x86_64.rpm glibc-debuginfo-common-2.12-1.47.el6_2.18.i686.rpm glibc-debuginfo-common-2.12-1.47.el6_2.18.x86_64.rpm glibc-static-2.12-1.47.el6_2.18.i686.rpm glibc-static-2.12-1.47.el6_2.18.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.4): Source: glibc-2.12-1.107.el6_4.10.src.rpm x86_64: glibc-debuginfo-2.12-1.107.el6_4.10.i686.rpm glibc-debuginfo-2.12-1.107.el6_4.10.x86_64.rpm glibc-debuginfo-common-2.12-1.107.el6_4.10.i686.rpm glibc-debuginfo-common-2.12-1.107.el6_4.10.x86_64.rpm glibc-static-2.12-1.107.el6_4.10.i686.rpm glibc-static-2.12-1.107.el6_4.10.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.5): Source: glibc-2.12-1.132.el6_5.9.src.rpm x86_64: glibc-debuginfo-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-static-2.12-1.132.el6_5.9.i686.rpm glibc-static-2.12-1.132.el6_5.9.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 6.5): Source: glibc-2.12-1.132.el6_5.9.src.rpm x86_64: glibc-debuginfo-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-2.12-1.132.el6_5.9.x86_64.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.i686.rpm glibc-debuginfo-common-2.12-1.132.el6_5.9.x86_64.rpm glibc-static-2.12-1.132.el6_5.9.i686.rpm glibc-static-2.12-1.132.el6_5.9.x86_64.rpm Red Hat Enterprise Linux Server Optional AUS (v. 6.6): x86_64: glibc-debuginfo-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-static-2.12-1.149.el6_6.12.i686.rpm glibc-static-2.12-1.149.el6_6.12.x86_64.rpm Red Hat Enterprise Linux Server Optional TUS (v. 6.6): x86_64: glibc-debuginfo-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-2.12-1.149.el6_6.12.x86_64.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.i686.rpm glibc-debuginfo-common-2.12-1.149.el6_6.12.x86_64.rpm glibc-static-2.12-1.149.el6_6.12.i686.rpm glibc-static-2.12-1.149.el6_6.12.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 6.7): i386: glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-static-2.12-1.166.el6_7.8.i686.rpm ppc64: glibc-debuginfo-2.12-1.166.el6_7.8.ppc.rpm glibc-debuginfo-2.12-1.166.el6_7.8.ppc64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.ppc.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.ppc64.rpm glibc-static-2.12-1.166.el6_7.8.ppc.rpm glibc-static-2.12-1.166.el6_7.8.ppc64.rpm s390x: glibc-debuginfo-2.12-1.166.el6_7.8.s390.rpm glibc-debuginfo-2.12-1.166.el6_7.8.s390x.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.s390.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.s390x.rpm glibc-static-2.12-1.166.el6_7.8.s390.rpm glibc-static-2.12-1.166.el6_7.8.s390x.rpm x86_64: glibc-debuginfo-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-2.12-1.166.el6_7.8.x86_64.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.i686.rpm glibc-debuginfo-common-2.12-1.166.el6_7.8.x86_64.rpm glibc-static-2.12-1.166.el6_7.8.i686.rpm glibc-static-2.12-1.166.el6_7.8.x86_64.rpm Red Hat Enterprise Linux ComputeNode EUS (v. 7.2): Source: glibc-2.17-106.el7_2.9.src.rpm x86_64: glibc-2.17-106.el7_2.9.i686.rpm glibc-2.17-106.el7_2.9.x86_64.rpm glibc-common-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-common-2.17-106.el7_2.9.x86_64.rpm glibc-devel-2.17-106.el7_2.9.i686.rpm glibc-devel-2.17-106.el7_2.9.x86_64.rpm glibc-headers-2.17-106.el7_2.9.x86_64.rpm glibc-utils-2.17-106.el7_2.9.x86_64.rpm nscd-2.17-106.el7_2.9.x86_64.rpm Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2): x86_64: glibc-debuginfo-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-common-2.17-106.el7_2.9.x86_64.rpm glibc-static-2.17-106.el7_2.9.i686.rpm glibc-static-2.17-106.el7_2.9.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.2): Source: glibc-2.17-106.el7_2.9.src.rpm ppc64: glibc-2.17-106.el7_2.9.ppc.rpm glibc-2.17-106.el7_2.9.ppc64.rpm glibc-common-2.17-106.el7_2.9.ppc64.rpm glibc-debuginfo-2.17-106.el7_2.9.ppc.rpm glibc-debuginfo-2.17-106.el7_2.9.ppc64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc64.rpm glibc-devel-2.17-106.el7_2.9.ppc.rpm glibc-devel-2.17-106.el7_2.9.ppc64.rpm glibc-headers-2.17-106.el7_2.9.ppc64.rpm glibc-utils-2.17-106.el7_2.9.ppc64.rpm nscd-2.17-106.el7_2.9.ppc64.rpm ppc64le: glibc-2.17-106.el7_2.9.ppc64le.rpm glibc-common-2.17-106.el7_2.9.ppc64le.rpm glibc-debuginfo-2.17-106.el7_2.9.ppc64le.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc64le.rpm glibc-devel-2.17-106.el7_2.9.ppc64le.rpm glibc-headers-2.17-106.el7_2.9.ppc64le.rpm glibc-utils-2.17-106.el7_2.9.ppc64le.rpm nscd-2.17-106.el7_2.9.ppc64le.rpm s390x: glibc-2.17-106.el7_2.9.s390.rpm glibc-2.17-106.el7_2.9.s390x.rpm glibc-common-2.17-106.el7_2.9.s390x.rpm glibc-debuginfo-2.17-106.el7_2.9.s390.rpm glibc-debuginfo-2.17-106.el7_2.9.s390x.rpm glibc-debuginfo-common-2.17-106.el7_2.9.s390.rpm glibc-debuginfo-common-2.17-106.el7_2.9.s390x.rpm glibc-devel-2.17-106.el7_2.9.s390.rpm glibc-devel-2.17-106.el7_2.9.s390x.rpm glibc-headers-2.17-106.el7_2.9.s390x.rpm glibc-utils-2.17-106.el7_2.9.s390x.rpm nscd-2.17-106.el7_2.9.s390x.rpm x86_64: glibc-2.17-106.el7_2.9.i686.rpm glibc-2.17-106.el7_2.9.x86_64.rpm glibc-common-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-common-2.17-106.el7_2.9.x86_64.rpm glibc-devel-2.17-106.el7_2.9.i686.rpm glibc-devel-2.17-106.el7_2.9.x86_64.rpm glibc-headers-2.17-106.el7_2.9.x86_64.rpm glibc-utils-2.17-106.el7_2.9.x86_64.rpm nscd-2.17-106.el7_2.9.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v. 7.2): ppc64: glibc-debuginfo-2.17-106.el7_2.9.ppc.rpm glibc-debuginfo-2.17-106.el7_2.9.ppc64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc64.rpm glibc-static-2.17-106.el7_2.9.ppc.rpm glibc-static-2.17-106.el7_2.9.ppc64.rpm ppc64le: glibc-debuginfo-2.17-106.el7_2.9.ppc64le.rpm glibc-debuginfo-common-2.17-106.el7_2.9.ppc64le.rpm glibc-static-2.17-106.el7_2.9.ppc64le.rpm s390x: glibc-debuginfo-2.17-106.el7_2.9.s390.rpm glibc-debuginfo-2.17-106.el7_2.9.s390x.rpm glibc-debuginfo-common-2.17-106.el7_2.9.s390.rpm glibc-debuginfo-common-2.17-106.el7_2.9.s390x.rpm glibc-static-2.17-106.el7_2.9.s390.rpm glibc-static-2.17-106.el7_2.9.s390x.rpm x86_64: glibc-debuginfo-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-2.17-106.el7_2.9.x86_64.rpm glibc-debuginfo-common-2.17-106.el7_2.9.i686.rpm glibc-debuginfo-common-2.17-106.el7_2.9.x86_64.rpm glibc-static-2.17-106.el7_2.9.i686.rpm glibc-static-2.17-106.el7_2.9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-1000366 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/security/vulnerabilities/stackguard 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFZSDV3XlSAg2UNWIIRAibeAKC2QtxViqngTTBVM9fvG1XjRCkgwACgrHP1 PVr1sUH9RUhxrQOKQqWtnKY= =ywUB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 6) - i386, x86_64 3. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201706-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: GNU C Library: Multiple vulnerabilities Date: June 20, 2017 Bugs: #608698, #608706, #622220 ID: 201706-19 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in the GNU C Library, the worst of which may allow execution of arbitrary code. Background ========== The GNU C library is the standard C library used by Gentoo Linux systems. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-libs/glibc < 2.23-r4 >= 2.23-r4 Description =========== Multiple vulnerabilities have been discovered in the GNU C Library. Please review the CVE identifiers and Qualys' security advisory referenced below for details. Impact ====== An attacker could possibly execute arbitrary code with the privileges of the process, escalate privileges or cause a Denial of Service condition. Workaround ========== There is no known workaround at this time. Resolution ========== All GNU C Library users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/glibc-2.23-r4" References ========== [ 1 ] CVE-2015-5180 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-5180 [ 2 ] CVE-2016-6323 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-6323 [ 3 ] CVE-2017-1000366 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-1000366 [ 4 ] Qualys Security Advisory - The Stack Clash https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201706-19 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2017 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 --cxbO5eT2swQBqr8k9tc6wcfapgLAJb4xR-- . SEC Consult Vulnerability Lab Security Advisory < 20190904-0 > ======================================================================= title: Multiple vulnerabilities product: Cisco RV340, Cisco RV340W, Cisco RV345, Cisco RV345P, Cisco RV260, Cisco RV260P, Cisco RV260W, Cisco 160, Cisco 160W vulnerable version: Cisco RV34X - 1.0.02.16, Cisco RV16X/26X - 1.0.00.15 fixed version: see "Solution" CVE number: - impact: High homepage: https://www.cisco.com/ found: 2019-05-15 by: T. Weber, S. Viehböck (Office Vienna) IoT Inspector SEC Consult Vulnerability Lab An integrated part of SEC Consult Europe | Asia | North America https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Securely connecting your small business to the outside world is as important as connecting your internal network devices to one another. Cisco Small Business RV Series Routers offer virtual private networking (VPN) technology so your remote workers can connect to your network through a secure Internet pathway." Source: https://www.cisco.com/c/en/us/products/routers/small-business-rv-series-routers/index.html Business recommendation: ------------------------ We want to thank Cisco for the very quick and professional response and great coordination. Customers are urged to update the firmware of their devices. Vulnerability overview/description: ----------------------------------- 1) Hardcoded Credentials The device contains hardcoded users and passwords which can be used to login via SSH on an emulated device at least. During the communication with Cisco it turned out that: "Accounts like the 'debug-admin' and 'root' can not be accessed from console port, CLI or webui". Therefore, these accounts had no real functionality and cannot be used for malicious actions. 2) Known GNU glibc Vulnerabilities The used GNU glibc in version 2.19 is outdated and contains multiple known vulnerabilities. The outdated version was found by IoT Inspector. One of the discovered vulnerabilities (CVE-2015-7547, "getaddrinfo() buffer overflow") was verified by using the MEDUSA scalable firmware runtime. 3) Known BusyBox Vulnerabilities The used BusyBox toolkit in version 1.23.2 is outdated and contains multiple known vulnerabilities. The outdated version was found by IoT Inspector. One of the discovered vulnerabilities (CVE-2017-16544) was verified by using the MEDUSA scaleable firmware runtime. 4) Multiple Vulnerabilities - IoT Inspector Report Further information can be found in IoT Inspector report: https://r.sec-consult.com/ciscoiot Proof of concept: ----------------- 1) Hardcoded Credentials The following hardcoded hashes were found in the 'shadow' file of the firmware: root:$1$hPNSjUZA$7eKqEpqVYltt9xJ6f0OGf0:15533:0:99999:7::: debug-admin:$1$.AAm0iJ4$na9wZwly9pSrdS8MhcGKw/:15541:0:99999:7::: [...] The undocumented user 'debug-admin' is also contained in this file. Starting the dropbear daemon as background process on emulated firmware: ------------------------------------------------------------------------------- # dropbear -E # [1109] <timestamp> Running in background # # [1112] <timestamp> Child connection from <IP>:52718 [1112] <timestamp> /var must be owned by user or root, and not writable by others [1112] <timestamp> Password auth succeeded for 'debug-admin' from <IP>:52718 ------------------------------------------------------------------------------- Log on via another host connected to the same network. For this PoC the password of the debug-admin was changed in the 'shadow' file. ------------------------------------------------------------------------------- [root@localhost medusa]# ssh debug-admin@<IP> /bin/ash -i debug-admin@<IP>'s password: /bin/ash: can't access tty; job control turned off BusyBox v1.23.2 (2018-11-21 18:22:56 IST) built-in shell (ash) /tmp $ ------------------------------------------------------------------------------- The 'debug-admin' user has the same privileges like 'root'. This can be determined from the corresponding sudoers file in the firmware: [...] ## User privilege specification ## root ALL=(ALL) ALL debug-admin ALL=(ALL) ALL ## Uncomment to allow members of group wheel to execute any command # %wheel ALL=(ALL) ALL [...] During the communication with Cisco it turned out that: "Accounts like the 'debug-admin' and 'root' can not be accessed from console port, CLI or webui". Therefore, these accounts had no real functionality and cannot be used for malicious actions. 2) Known GNU glibc Vulnerabilities GNU glibc version 2.19 contains multiple CVEs like: CVE-2014-4043, CVE-2014-9402, CVE-2014-9761, CVE-2014-9984, CVE-2015-1472, CVE-2015-5277, CVE-2015-8778, CVE-2015-8779, CVE-2017-1000366 and more. The getaddrinfo() buffer overflow vulnerability was checked with the help of the exploit code from https://github.com/fjserna/CVE-2015-7547. It was compiled and executed on the emulated device to test the system. # python cve-2015-7547-poc.py & [1] 961 # chroot /medusa_rootfs/ bin/ash BusyBox v1.23.2 (2018-11-21 18:22:56 IST) built-in shell (ash) # gdb cve-2015-7547_glibc_getaddrinfo [...] [UDP] Total Data len recv 36 [UDP] Total Data len recv 36 Connected with 127.0.0.1:41782 [TCP] Total Data len recv 76 [TCP] Request1 len recv 36 [TCP] Request2 len recv 36 Cannot access memory at address 0x4 Program received signal SIGSEGV, Segmentation fault. 0x76f1fd58 in ?? () from /lib/libc.so.6 (gdb) References: https://security.googleblog.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html https://github.com/fjserna/CVE-2015-7547 3) Known BusyBox Vulnerabilities BusyBox version 1.23.2 contains multiple CVEs like: CVE-2016-2148, CVE-2016-6301, CVE-2015-9261, CVE-2016-2147, CVE-2018-20679, CVE-2017-16544 and CVE-2019-5747. The BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verified on an emulated device: A file with the name "\ectest\n\e]55;test.txt\a" was created to trigger the vulnerability. ------------------------------------------------------------------------------- # ls "pressing <TAB>" test ]55;test.txt # ------------------------------------------------------------------------------- 4) Multiple Vulnerabilities - IoT Inspector Report Further information can be found in IoT Inspector report: https://r.sec-consult.com/ciscoiot The summary is below: IoT Inspector Vulnerability #1 BusyBox CVE entries Outdated BusyBox version is affected by 7 published CVEs. IoT Inspector Vulnerability #2 curl CVE entries Outdated curl version is affected by 35 published CVEs. IoT Inspector Vulnerability #3 GNU glibc CVE entries Outdated GNU glibc version is affected by 44 published CVEs. IoT Inspector Vulnerability #4 GNU glibc getaddrinfo() buffer overflow Outdated GNU glibc version is affected by CVE-2015-7547. IoT Inspector Vulnerability #5 Hardcoded password hashes Firmware contains multiple hardcoded credentials. IoT Inspector Vulnerability #6 Linux Kernel CVE entries Outdated Linux Kernel version affected by 512 published CVEs. IoT Inspector Vulnerability #7 MiniUPnPd CVE entries Outdated MiniUPnPd version affected by 2 published CVEs. IoT Inspector Vulnerability #8 Dnsmasq CVE entries Outdated MiniUPnPd version affected by 1 published CVE. IoT Inspector Vulnerability #9 Linux Kernel Privilege Escalation “pp_key” Outdated Linux Kernel version is affected by CVE-2015-7547. IoT Inspector Vulnerability #10 OpenSSL CVE entries Outdated OpenSSL version affected by 6 published CVEs. Vulnerable / tested versions: ----------------------------- The following firmware versions have been tested with IoT Inspector and firmware emulation techniques: Cisco RV340 / 1.0.02.16 Cisco RV340W / 1.0.02.16 Cisco RV345 / 1.0.02.16 Cisco RV345P / 1.0.02.16 The following firmware versions have been tested with IoT Inspector only: Cisco RV260 / 1.0.00.15 Cisco RV260P / 1.0.00.15 Cisco RV260W / 1.0.00.15 Cisco RV160 / 1.0.00.15 Cisco RV160P / 1.0.00.15 The firmware was obtained from the vendor website: https://software.cisco.com/download/home/286287791/type/282465789/release/1.0.02.16 https://software.cisco.com/download/home/286316464/type/282465789/release/1.0.00.15 Vendor contact timeline: ------------------------ 2019-05-15: Contacting vendor through psirt@cisco.com. 2019-05-16: Vendor confirmed the receipt. 2019-05-2019-08: Periodic updates about the investigation from the vendor. Clarification which of the reported issues will be fixed. 2019-08-20: The vendor proposed the next possible publication date for the advisory for 2019-09-04. The vendor added the RV160 and RV260 router series to be vulnerable to the same issues too. 2019-09-04: Coordinated advisory release. Solution: --------- Upgrade to the newest available firmware version. Additionally, the vendor provides the following security notice: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-sb-vpnrouter Workaround: ----------- None. Advisory URL: ------------- https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SEC Consult Vulnerability Lab SEC Consult Europe | Asia | North America About SEC Consult Vulnerability Lab The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers. Hence our customers obtain the most current information about vulnerabilities and valid recommendation about the risk profile of new technologies. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Interested to work with the experts of SEC Consult? Send us your application https://www.sec-consult.com/en/career/index.html Interested in improving your cyber security with the experts of SEC Consult? Contact our local offices https://www.sec-consult.com/en/contact/index.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult EOF T. Weber / @2019 . ========================================================================== Ubuntu Security Notice USN-3323-2 June 29, 2017 eglibc vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.04 ESM Summary: Gnu C library could be made to run programs as an administrator. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.04 ESM: libc6 2.15-0ubuntu10.20 After a standard system update you need to reboot your computer to make all the necessary changes. Description: Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix(es): * It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. (CVE-2017-7512) The underlying container image was also rebuilt to resolve other security issues. Solution: To apply this security fix, use the updated docker images. Bugs fixed (https://bugzilla.redhat.com/): 1457997 - CVE-2017-7512 3scale AMP: validation bypass in oauth 5

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

buffer error

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

T. Weber

SOURCES

LAST UPDATE DATE

2025-04-22T22:27:48.074000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE