ld.so in the GNU C Library (aka glibc or libc6) before 2.11.3, and 2.12.x before 2.12.2, does not properly restrict use of the LD_AUDIT environment variable to reference dynamic shared objects (DSOs) as audit objects, which allows local users to gain privileges by leveraging an unsafe DSO located in a trusted library directory, as demonstrated by libpcprofile.so.

The remote NewStart CGSL host, running version MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - elf/dl-load.c in ld.so in the GNU C Library (aka glibc     or libc6) through 2.11.2, and 2.12.x through 2.12.1,     does not properly handle a value of $ORIGIN for the     LD_AUDIT environment variable, which allows local users     to gain privileges via a crafted dynamic shared object     (DSO) located in an arbitrary directory. (CVE-2010-3847)

  - ld.so in the GNU C Library (aka glibc or libc6) before     2.11.3, and 2.12.x before 2.12.2, does not properly     restrict use of the LD_AUDIT environment variable to     reference dynamic shared objects (DSOs) as audit     objects, which allows local users to gain privileges by     leveraging an unsafe DSO located in a trusted library     directory, as demonstrated by libpcprofile.so.
    (CVE-2010-3856)

  - Integer overflow in string/strcoll_l.c in the GNU C     Library (aka glibc or libc6) 2.17 and earlier allows     context-dependent attackers to cause a denial of service     (crash) or possibly execute arbitrary code via a long     string, which triggers a heap-based buffer overflow.
    (CVE-2012-4412)

  - Stack-based buffer overflow in string/strcoll_l.c in the     GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via a     long string that triggers a malloc failure and use of     the alloca function. (CVE-2012-4424)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide specially-     crafted input that, when processed, would cause the     application to crash. (CVE-2013-0242)

  - It was found that getaddrinfo() did not limit the amount     of stack memory used during name resolution. An attacker     able to make an application resolve an attacker-     controlled hostname or IP address could possibly cause     the application to exhaust all stack memory and crash.
    (CVE-2013-1914, CVE-2013-4458)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on the     files and obtain access to arbitrary pseudo-terminals by     leveraging a FUSE file system. (CVE-2013-2207)

  - An out-of-bounds write flaw was found in the way the     glibc's readdir_r() function handled file system entries     longer than the NAME_MAX character constant. A remote     attacker could provide a specially crafted NTFS or CIFS     file system that, when processed by an application using     readdir_r(), would cause that application to crash or,     potentially, allow the attacker to execute arbitrary     code with the privileges of the user running the     application. (CVE-2013-4237)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory allocator     functions (pvalloc, valloc, and memalign). If an     application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application. (CVE-2013-4332)

  - The PTR_MANGLE implementation in the GNU C Library (aka     glibc or libc6) 2.4, 2.17, and earlier, and Embedded     GLIBC (EGLIBC) does not initialize the random value for     the pointer guard, which makes it easier for context-     dependent attackers to control execution flow by     leveraging a buffer-overflow vulnerability in an     application and using the known zero value pointer guard     to calculate a pointer address. (CVE-2013-4788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including arbitrary code execution vulnerabilities, in several third-party components and libraries :

  - glibc
  - glibc-common
  - nscd
  - openldap
  - sudo

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Switch to use malloc when the input line is too long     [Orabug 19951108]

  - Use a /sys/devices/system/cpu/online for
    _SC_NPROCESSORS_ONLN implementation [Orabug 17642251]     (Joe Jin)

  - Fix parsing of numeric hosts in gethostbyname_r     (CVE-2015-0235, #1183532).

  - Remove gconv transliteration loadable modules support     (CVE-2014-5119, - _nl_find_locale: Improve handling of     crafted locale names (CVE-2014-0475, 

  - Fix patch for integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Fix return code when starting an already started nscd     daemon (#979413).

  - Fix getnameinfo for many PTR record queries (#1020486).

  - Return EINVAL error for negative sizees to getgroups     (#995207).

  - Fix integer overflows in *valloc and memalign.
    (CVE-2013-4332, #1011805).

  - Add support for newer L3 caches on x86-64 and correctly     count the number of hardware threads sharing a cacheline     (#1003420).

  - Revert incomplete fix for bug #758193.

  - Fix _nl_find_msg malloc failure case, and callers     (#957089).

  - Test on init_fct, not result->__init_fct, after     demangling (#816647).

  - Don't handle ttl == 0 specially (#929035).

  - Fix multibyte character processing crash in regexp     (CVE-2013-0242, #951132)

  - Fix getaddrinfo stack overflow resulting in application     crash (CVE-2013-1914, #951132)

  - Add missing patch to avoid use after free (#816647)

  - Fix race in initgroups compat_call (#706571)

  - Fix return value from getaddrinfo when servers are down.
    (#758193)

  - Fix fseek on wide character streams. Sync's seeking code     with RHEL 6 (#835828)

  - Call feraiseexcept only if exceptions are not masked     (#861871).

  - Always demangle function before checking for NULL value.
    (#816647).

  - Do not fail in ttyname if /proc is not available     (#851450).

  - Fix errno for various overflow situations in vfprintf.
    Add missing overflow checks. (#857387)

  - Handle failure of _nl_explode_name in all cases     (#848481)

  - Define the default fuzz factor to 2 to make it easier to     manipulate RHEL 5 RPMs on RHEL 6 and newer systems.

  - Fix race in intl/* testsuite (#849202)

  - Fix out of bounds array access in strto* exposed by     847930 patch.

  - Really fix POWER4 strncmp crash (#766832).

  - Fix integer overflow leading to buffer overflow in     strto* (#847930)

  - Fix race in msort/qsort (#843672)

  - Fix regression due to 797096 changes (#845952)

  - Do not use PT_IEEE_IP ptrace calls (#839572)

  - Update ULPs (#837852)

  - Fix various transcendentals in non-default rounding     modes (#837852)

  - Fix unbound alloca in vfprintf (#826947)

  - Fix iconv segfault if the invalid multibyte character     0xffff is input when converting from IBM930. (#823905)

  - Fix fnmatch when '*' wildcard is applied on a file name     containing multibyte chars. (#819430)

  - Fix unbound allocas use in glob_in_dir, getaddrinfo and     others. (#797096)

  - Fix segfault when running ld.so --verify on some DSO's     in current working directory. (#808342)

  - Incorrect initialization order for dynamic loader     (#813348)

  - Fix return code when stopping already stopped nscd     daemon (#678227)

  - Remove MAP_32BIT for pthread stack mappings, use     MAP_STACK instead (#641094)

  - Fix setuid vs sighandler_setxid race (#769852)

  - Fix access after end of search string in regex matcher     (#757887)

  - Fix POWER4 strncmp crash (#766832)

  - Fix SC_*CACHE detection for X5670 cpus (#692182)

  - Fix parsing IPV6 entries in /etc/resolv.conf (#703239)

  - Fix double-free in nss_nis code (#500767)

  - Add kernel VDSO support for s390x (#795896)

  - Fix race in malloc arena creation and make     implementation match documented behaviour (#800240)

  - Do not override TTL of CNAME with TTL of its alias     (#808014)

  - Fix short month names in fi_FI locale #(657266).

  - Fix nscd crash for group with large number of members     (#788989)

  - Fix Slovakia currency (#799853)

  - Fix getent malloc failure check (#806403)

  - Fix short month names in zh_CN locale (#657588)

  - Fix decimal point symbol for Portuguese currency     (#710216)

  - Avoid integer overflow in sbrk (#767358)

  - Avoid race between [,__de]allocate_stack and
    __reclaim_stacks during fork (#738665)

  - Fix race between IO_flush_all_lockp & pthread_cancel     (#751748)

  - Fix memory leak in NIS endgrent (#809325)

  - Allow getaddr to accept SCTP socket types in hints     (#765710)

  - Fix errno handling in vfprintf (#794814)

  - Filter out <built-in> when building file lists     (#784646).

  - Avoid 'nargs' integer overflow which could be used to     bypass FORTIFY_SOURCE (#794814)

  - Fix currency_symbol for uk_UA (#639000)

  - Correct test for detecting cycle during topo sort     (#729661)

  - Check values from TZ file header (#767688)

  - Complete the numeric settings fix (#675259)

  - Complete the change for error codes from pthread_create     (#707998)

  - Truncate time values in Linux futimes when falling back     to utime (#758252)

  - Update systemtaparches

  - Add rules to build libresolv with SSP flags (#756453)

  - Fix PLT reference

  - Workaround misconfigured system (#702300)

  - Update systemtaparches

  - Correct cycle detection during dependency sorting     (#729661)

  - Add gdb hooks (#711924)

  - Fix alloca accounting in strxfm and strcoll (#585433)

  - Correct cycle detection during dependency sorting     (#729661)

  - ldd: never run file directly (#531160)

  - Implement greedy matching of weekday and month names     (#657570)

  - Fix incorrect numeric settings (#675259)

  - Implement new mode for NIS passwd.adjunct.byname table     (#678318)

  - Query NIS domain only when needed (#703345)

  - Count total processors using sysfs (#706894)

  - Translate clone error if necessary (#707998)

  - Workaround kernel clobbering robust list (#711531)

  - Use correct type when casting d_tag (#599056,     CVE-2010-0830)

  - Report write error in addmnt even for cached streams     (#688980, CVE-2011-1089)

  - Don't underestimate length of DST substitution (#694655)

  - Don't allocate executable stack when it cannot be     allocated in the first 4G (#448011)

  - Initialize resolver state in nscd (#676039)

  - No cancel signal in unsafe places (#684808)

  - Check size of pattern in wide character representation     in fnmatch (#681054)

  - Avoid too much stack use in fnmatch (#681054,     CVE-2011-1071)

  - Properly quote output of locale (#625893, CVE-2011-1095)

  - Don't leave empty element in rpath when skipping the     first element, ignore rpath elements containing     non-isolated use of $ORIGIN when privileged (#667974,     CVE-2011-0536)

  - Fix handling of newline in addmntent (#559579,     CVE-2010-0296)

  - Don't ignore $ORIGIN in libraries (#670988)

  - Fix false assertion (#604796)

  - Fix ordering of DSO constructors and destructors     (#604796)

  - Fix typo (#531576)

  - Fix concurrency problem between dl_open and     dl_iterate_phdr (#649956)

  - Require suid bit on audit objects in privileged programs     (#645678, CVE-2010-3856)

  - Never expand $ORIGIN in privileged programs (#643819,     CVE-2010-3847)

  - Add timestamps to nscd logs (#527558)

  - Fix index wraparound handling in memusage (#531576)

  - Handle running out of buffer space with IPv6 mapping     enabled (#533367)

  - Don't deadlock in __dl_iterate_phdr while (un)loading     objects (#549813)

  - Avoid alloca in setenv for long strings (#559974)

  - Recognize POWER7 and ISA 2.06 (#563563)

  - Add support for AT_BASE_PLATFORM (#563599)

  - Restore locking in free_check (#585674)

  - Fix lookup of collation sequence value during regexp     matching (#587360)

  - Fix POWER6 memcpy/memset (#579011)

  - Fix scope handling during dl_close (#593675)

  - Enable -fasynchronous-unwind-tables throughout (#593047)

  - Fix crash when aio thread creation fails (#566712)

This update of glibc fixes two bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

From Red Hat Security Advisory 2010:0872 :

Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

It was discovered that the glibc dynamic linker/loader did not handle the $ORIGIN dynamic string token set in the LD_AUDIT environment variable securely. A local attacker with write access to a file system containing setuid or setgid binaries could use this flaw to escalate their privileges. (CVE-2010-3847)

It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)

Red Hat would like to thank Tavis Ormandy for reporting the CVE-2010-3847 issue, and Ben Hawkes and Tavis Ormandy for reporting the CVE-2010-3856 issue.

This update also fixes the following bugs :

* Previously, the generic implementation of the strstr() and memmem() functions did not handle certain periodic patterns correctly and could find a false positive match. This error has been fixed, and both functions now work as expected. (BZ#643341)

* The 'TCB_ALIGNMENT' value has been increased to 32 bytes to prevent applications from crashing during symbol resolution on 64-bit systems with support for Intel AVX vector registers. (BZ#643343)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2010:0793 :

Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)

Red Hat would like to thank Ben Hawkes and Tavis Ormandy for reporting this issue.

All users should upgrade to these updated packages, which contain a backported patch to correct this issue.

It was discovered that the glibc dynamic linker/loader did not handle the $ORIGIN dynamic string token set in the LD_AUDIT environment variable securely. A local attacker with write access to a file system containing setuid or setgid binaries could use this flaw to escalate their privileges. (CVE-2010-3847)

It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)

This update also fixes the following bugs :

  - Previously, the generic implementation of the strstr()     and memmem() functions did not handle certain periodic     patterns correctly and could find a false positive     match. This error has been fixed, and both functions now     work as expected. (BZ#643341)

  - The 'TCB_ALIGNMENT' value has been increased to 32 bytes     to prevent applications from crashing during symbol     resolution on 64-bit systems with support for Intel AVX     vector registers. (BZ#643343)

USN-1009-1 fixed vulnerabilities in the GNU C library. Colin Watson discovered that the fixes were incomplete and introduced flaws with setuid programs loading libraries that used dynamic string tokens in their RPATH. If the 'man' program was installed setuid, a local attacker could exploit this to gain 'man' user privileges, potentially leading to further privilege escalations. Default Ubuntu installations were not affected.

Tavis Ormandy discovered multiple flaws in the GNU C Library's handling of the LD_AUDIT environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges. (CVE-2010-3847, CVE-2010-3856).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

a. Service Console update for glibc

   The service console packages glibc, glibc-common, and nscd are each    updated to version 2.5-34.4908.vmw.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-3847 and CVE-2010-3856 to the issues    addressed in this update.

b. Service Console update for sudo

   The service console package sudo is updated to version    1.7.2p1-8.el5_5.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-2956 to the issue addressed in this    update.

c. Service Console update for openldap

   The service console package openldap is updated to version    2.3.43-12.el5_5.1.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the names CVE-2010-0211 and CVE-2010-0212 to the issues    addressed in this update.

This update of glibc fixes various bugs and security issues :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, multi on     in /etc/host.conf would be ignored when nscd was used,     breaking e.g. resolving records in /etc/hosts where     single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

Updated glibc packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)

Red Hat would like to thank Ben Hawkes and Tavis Ormandy for reporting this issue.

All users should upgrade to these updated packages, which contain a backported patch to correct this issue.

Updated glibc packages that fix two security issues and two bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages contain the standard C libraries used by multiple programs on the system. These packages contain the standard C and the standard math libraries. Without these two libraries, a Linux system cannot function properly.

It was discovered that the glibc dynamic linker/loader did not handle the $ORIGIN dynamic string token set in the LD_AUDIT environment variable securely. A local attacker with write access to a file system containing setuid or setgid binaries could use this flaw to escalate their privileges. (CVE-2010-3847)

It was discovered that the glibc dynamic linker/loader did not perform sufficient safety checks when loading dynamic shared objects (DSOs) to provide callbacks for its auditing API during the execution of privileged programs. A local attacker could use this flaw to escalate their privileges via a carefully-chosen system DSO library containing unsafe constructors. (CVE-2010-3856)

Red Hat would like to thank Tavis Ormandy for reporting the CVE-2010-3847 issue, and Ben Hawkes and Tavis Ormandy for reporting the CVE-2010-3856 issue.

This update also fixes the following bugs :

* Previously, the generic implementation of the strstr() and memmem() functions did not handle certain periodic patterns correctly and could find a false positive match. This error has been fixed, and both functions now work as expected. (BZ#643341)

* The 'TCB_ALIGNMENT' value has been increased to 32 bytes to prevent applications from crashing during symbol resolution on 64-bit systems with support for Intel AVX vector registers. (BZ#643343)

All users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote host is affected by the vulnerability described in GLSA-201011-01 (GNU C library: Multiple vulnerabilities)

    Multiple vulnerabilities were found in glibc, amongst others the     widely-known recent LD_AUDIT and $ORIGIN issues. For further     information please consult the CVE entries referenced below.
  Impact :

    A local attacker could execute arbitrary code as root, cause a Denial     of Service, or gain privileges. Additionally, a user-assisted remote     attacker could cause the execution of arbitrary code, and a     context-dependent attacker could cause a Denial of Service.
  Workaround :

    There is no known workaround at this time.

- Correct x86 CPU family and model check (BZ#11640,     #596554)

    - Don't crash on unresolved weak symbol reference

    - sunrpc: Fix spurious fall-through

    - Never expand $ORIGIN in privileged programs (#643306,       CVE-2010-3847)

    - Require suid bit on audit objects in privileged       programs (CVE-2010-3856)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Require suid bit on audit objects in privileged programs (CVE-2010-3856)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New glibc packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, and -current to fix a security issue.

Several security issues were fixed :

  - Decoding of the $ORIGIN special value in various LD_     environment variables allowed local attackers to execute     code in context of e.g. setuid root programs, elevating     privileges. This issue does not affect SUSE as an     assertion triggers before the respective code is     executed. The bug was fixed nevertheless.
    (CVE-2010-3847)

  - The LD_AUDIT environment was not pruned during setuid     root execution and could load shared libraries from     standard system library paths. This could be used by     local attackers to inject code into setuid root programs     and so elevated privileges. (CVE-2010-3856)

  - Integer overflow causing arbitrary code execution in     ld.so --verify mode could be induced by a specially     crafted binary. (CVE-2010-0830)

  - The addmntent() function would not escape the newline     character properly, allowing the user to insert     arbitrary newlines to the /etc/mtab; if the addmntent()     is run by a setuid mount binary that does not do extra     input checking, this would allow custom entries to be     inserted in /etc/mtab. (CVE-2010-0296)

  - The strfmon() function contains an integer overflow     vulnerability in width specifiers handling that could be     triggered by an attacker that can control the format     string passed to strfmon(). (CVE-2008-1391)

  - Some setups (mainly Solaris-based legacy setups) include     shadow information (password hashes) as so-called     'adjunct passwd' table, mangling it with the rest of     passwd columns instead of keeping it in the shadow     table. Normally, Solaris will disclose this information     only to clients bound to a priviledged port, but when     nscd is deployed on the client, getpwnam() would     disclose the password hashes to all users. New mode     'adjunct as shadow' can now be enabled in     /etc/default/nss that will move the password hashes from     the world-readable passwd table to emulated shadow table     (that is not cached by nscd). (CVE-2010-0015)

Some invalid behavior, crashes and memory leaks were fixed :

  - nscd in the paranoia mode would crash on the periodic     restart in case one of the databases was disabled in the     nscd configuration.

  - When closing a widechar stdio stream, memory would     sometimes be leaked.

  - memcpy() on power6 would errorneously use a 64-bit     instruction within 32-bit code in certain corner cases.

  - jrand48() returns numbers in the wrong range on 64-bit     systems: Instead of [-231, +231), the value was always     positive and sometimes higher than the supposed upper     bound.

  - Roughly every 300 days of uptime, the times() function     would report an error for 4096 seconds, a side-effect of     how system calls are implemented on i386. glibc was     changed to never report an error and crash an     application that would trigger EFAULT by kernel (because     of invalid pointer passed to the times() syscall)     before.

  - getifaddrs() would report infiniband interfaces with     corrupted ifa_name structure field.

  - getgroups(-1) normally handles the invalid array size     gracefully by setting EINVAL. However, a crash would be     triggered in case the code was compiled using     '-DFORTIFYSOURCE=2 -O2'.

  - Pthread cleanup handlers would not always be invoked on     thread cancellation (e.g. in RPC code, but also in other     parts of glibc that may hang outside of a syscall) -     glibc is now compiled with

    -fasynchronous-unwind-tables. Some other minor issues     were fixed :

  - There was a problem with sprof<->dlopen() interaction     due to a missing flag in the internal dlopen() wrapper.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

This update of glibc fixes various bugs and security issues :

CVE-2010-3847: Decoding of the $ORIGIN special value in various LD_ environment variables allowed local attackers to execute code in context of e.g. setuid root programs, elevating privileges. This issue does not affect SUSE as an assertion triggers before the respective code is executed. The bug was fixed nevertheless.

CVE-2010-3856: The LD_AUDIT environment was not pruned during setuid root execution and could load shared libraries from standard system library paths. This could be used by local attackers to inject code into setuid root programs and so elevated privileges.

CVE-2010-0830: Integer overflow causing arbitrary code execution in ld.so

--verify mode could be induced by a specially crafted binary.

CVE-2010-0296: The addmntent() function would not escape the newline character properly, allowing the user to insert arbitrary newlines to the /etc/mtab; if the addmntent() is run by a setuid mount binary that does not do extra input checking, this would allow custom entries to be inserted in /etc/mtab.

CVE-2008-1391: The strfmon() function contains an integer overflow vulnerability in width specifiers handling that could be triggered by an attacker that can control the format string passed to strfmon().

CVE-2010-0015: Some setups (mainly Solaris-based legacy setups) include shadow information (password hashes) as so-called 'adjunct passwd' table, mangling it with the rest of passwd columns instead of keeping it in the shadow table. Normally, Solaris will disclose this information only to clients bound to a priviledged port, but when nscd is deployed on the client, getpwnam() would disclose the password hashes to all users. New mode 'adjunct as shadow' can now be enabled in /etc/default/nss that will move the password hashes from the world-readable passwd table to emulated shadow table (that is not cached by nscd).

Some invalid behaviour, crashes and memory leaks were fixed :

  - statfs64() would not function properly on IA64 in ia32el     emulation mode.

  - memcpy() and memset() on power6 would erroneously use a     64-bit instruction within 32-bit code in certain corner     cases.

  - nscd would not load /etc/host.conf properly before     performing host resolution - most importantly, `multi     on` in /etc/host.conf would be ignored when nscd was     used, breaking e.g. resolving records in /etc/hosts     where single name would point at multiple addresses

  - Removed mapping from lowercase sharp s to uppercase     sharp S; uppercase S is not a standardly used letter and     causes problems for ISO encodings.

Some other minor issues were fixed :

  - glibc-locale now better coexists with sap-locale on     upgrades by regenerating the locale/gconv indexes     properly.

  - Ports 623 and 664 may not be allocated by RPC code     automatically anymore since that may clash with ports     used on some IPMI network cards.

  - On x86_64, backtrace of a static destructor would stop     in the _fini() glibc pseudo-routine, making it difficult     to find out what originally triggered the program     termination. The routine now has unwind information     attached.

A vulnerability in the GNU C library (glibc) was discovered which could escalate the privilegies for local users (CVE-2010-3856).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct this issue.

Tavis Ormandy discovered multiple flaws in the GNU C Library's handling of the LD_AUDIT environment variable when running a privileged binary. A local attacker could exploit this to gain root privileges. (CVE-2010-3847, CVE-2010-3856).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ben Hawkes and Tavis Ormandy discovered that the dynamic loader in GNU libc allows local users to gain root privileges using a crafted LD_AUDIT environment variable.

ID	Name	Product	Family	Severity
127161	NewStart CGSL MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2019-0012)	Nessus	NewStart CGSL Local Security Checks	high
89673	VMware ESX Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0001) (remote check)	Nessus	Misc.	high
81118	OracleVM 3.2 : glibc (OVMSA-2015-0023) (GHOST)	Nessus	OracleVM Local Security Checks	high
75518	openSUSE Security Update : glibc (openSUSE-SU-2010:0912-1)	Nessus	SuSE Local Security Checks	high
68141	Oracle Linux 6 : glibc (ELSA-2010-0872)	Nessus	Oracle Linux Local Security Checks	high
68126	Oracle Linux 5 : glibc (ELSA-2010-0793)	Nessus	Oracle Linux Local Security Checks	high
60891	Scientific Linux Security Update : glibc on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
51501	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : eglibc, glibc vulnerability (USN-1009-2)	Nessus	Ubuntu Local Security Checks	high
51422	VMSA-2011-0001 : VMware ESX third-party updates for Service Console packages glibc, sudo, and openldap	Nessus	VMware ESX Local Security Checks	high
50912	SuSE 11 / 11.1 Security Update : glibc (SAT Patch Numbers 3392 / 3393)	Nessus	SuSE Local Security Checks	high
50798	CentOS 5 : glibc (CESA-2010:0793)	Nessus	CentOS Local Security Checks	high
50640	RHEL 6 : glibc (RHSA-2010:0872)	Nessus	Red Hat Local Security Checks	high
50605	GLSA-201011-01 : GNU C library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
50421	Fedora 12 : glibc-2.11.2-3 (2010-16641)	Nessus	Fedora Local Security Checks	high
50401	Fedora 14 : glibc-2.12.90-18 (2010-16851)	Nessus	Fedora Local Security Checks	high
50399	Fedora 13 : glibc-2.12.1-4 (2010-16655)	Nessus	Fedora Local Security Checks	high
50388	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / current : glibc (SSA:2010-301-01)	Nessus	Slackware Local Security Checks	high
50377	SuSE 10 Security Update : glibc (ZYPP Patch Number 7201)	Nessus	SuSE Local Security Checks	high
50373	openSUSE Security Update : glibc (openSUSE-SU-2010:0913-1)	Nessus	SuSE Local Security Checks	high
50367	openSUSE Security Update : glibc (openSUSE-SU-2010:0914-1)	Nessus	SuSE Local Security Checks	high
50341	RHEL 5 : glibc (RHSA-2010:0793)	Nessus	Red Hat Local Security Checks	high
50321	Mandriva Linux Security Advisory : glibc (MDVSA-2010:212)	Nessus	Mandriva Local Security Checks	high
50318	Ubuntu 8.04 LTS / 9.04 / 9.10 / 10.04 LTS / 10.10 : glibc, eglibc vulnerabilities (USN-1009-1)	Nessus	Ubuntu Local Security Checks	high
50309	Debian DSA-2122-1 : glibc - missing input sanitization	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-3856

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high