[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
OVAL

CESA-2012:0126 -- centos 5 glibc

ID: oval:org.secpod.oval:def:202235Date: (C)2012-03-27   (M)2024-03-25
Class: PATCHFamily: unix




The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library read timezone files. If a carefully-crafted timezone file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. A flaw was found in the way the ldd utility identified dynamically linked libraries. If an attacker could trick a user into running ldd on a malicious binary, it could result in arbitrary code execution with the privileges of the user running ldd. An integer overflow flaw, leading to a heap-based buffer overflow, was found in the way the glibc library loaded ELF files. If a carefully-crafted ELF file was loaded by an application linked against glibc, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. It was found that the glibc addmntent function, used by various mount helper utilities, did not handle certain errors correctly when updating the mtab file. If such utilities had the setuid bit set, a local attacker could use this flaw to corrupt the mtab file. A denial of service flaw was found in the remote procedure call implementation in glibc. A remote attacker able to open a large number of connections to an RPC service that is using the RPC implementation from glibc, could use this flaw to make that service use an excessive amount of CPU time. Red Hat would like to thank the Ubuntu Security Team for reporting CVE-2010-0830, and Dan Rosenberg for reporting CVE-2011-1089. The Ubuntu Security Team acknowledges Dan Rosenberg as the original reporter of CVE-2010-0830. Users should upgrade to these updated packages, which resolve these issues.

Platform:
CentOS 5
Product:
glibc
Reference:
CESA-2012:0126
CVE-2009-5029
CVE-2009-5064
CVE-2010-0830
CVE-2011-1089
CVE-2011-4609
CVE    5
CVE-2011-1089
CVE-2011-4609
CVE-2009-5029
CVE-2009-5064
...
CPE    2
cpe:/a:glibc:glibc
cpe:/o:centos:centos:5

© SecPod Technologies