GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.

Updated glibc packages that address several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

It was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.

This erratum addresses the following bugs in the GNU C Library :

  - fix stack alignment in IA-32 clone - fix double free in     globfree - fix fnmatch to avoid jumping based on     uninitialized memory read - fix fseekpos after ungetc -     fix TZ env var handling if the variable ends with + or -
    - avoid depending on values read from uninitialized     memory in strtold on certain architectures - fix mapping     alignment computation in dl-load - fix i486+ strncat     inline assembly - make gethostid/sethostid work on     bi-arch platforms - fix ppc64 getcontext/swapcontext -     fix pthread_exit if called after pthread_create, but     before the created thread actually started - fix return     values for tgamma (+-0) - fix handling of very long     lines in /etc/hosts - avoid page aliasing of thread     stacks on AMD64 - avoid busy loop in malloc if     concurrent with fork - allow putenv and setenv in shared     library constructors - fix restoring of CCR in     swapcontext and getcontext on ppc64 - avoid using     sigaction (SIGPIPE, ...) in syslog implementation

All users of glibc should upgrade to these updated packages, which resolve these issues.

Updated glibc packages that address several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

Flaws in the catchsegv and glibcbug scripts were discovered. A local user could utilize these flaws to overwrite files via a symlink attack on temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0968 and CVE-2004-1382 to these issues.

It was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.

This erratum also addresses the following bugs in the GNU C Library: - Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation - Fixed poll on Itanium - Now allows setenv/putenv in shared library constructors

Users of glibc are advised to upgrade to these erratum packages that remove the unnecessary glibcbug script and contain backported patches to correct these other issues.

The remote host is affected by the vulnerability described in GLSA-200408-16 (glibc: Information leak with LD_DEBUG)

    Silvio Cesare discovered a potential information leak in glibc. It     allows LD_DEBUG on SUID binaries where it should not be allowed. This     has various security implications, which may be used to gain     confidential information.
  Impact :

    An attacker can gain the list of symbols a SUID application uses and     their locations and can then use a trojaned library taking precendence     over those symbols to gain information or perform further exploitation.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version of glibc.

ID	Name	Product	Family	Severity
21800	CentOS 3 : glibc (CESA-2005:256)	Nessus	CentOS Local Security Checks	low
18312	RHEL 3 : glibc (RHSA-2005:256)	Nessus	Red Hat Local Security Checks	low
18160	RHEL 2.1 : glibc (RHSA-2005:261)	Nessus	Red Hat Local Security Checks	low
14572	GLSA-200408-16 : glibc: Information leak with LD_DEBUG	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-1453

medium

Tenable Plugins

low

low

low

low