iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.

glibc has been updated to fix security issues :

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, CVE-2012-6656, bsc#894553, bsc#894556,     GLIBC BZ #17325, GLIBC BZ #14134)

  - Fixed a stack overflow during hosts parsing     (CVE-2013-4357)

  - Copy filename argument in     posix_spawn_file_actions_addopen (CVE-2014-4043,     bsc#882600, BZ #17048)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc has been updated to fix a security issue and two bugs :

Security issue fixed :

  - Copy filename argument in     posix_spawn_file_actions_addopen (CVE-2014-4043)

Bugs fixed :

  - don't touch user-controlled stdio locks in forked child     (bsc#864081, GLIBC BZ #12847)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc has been updated to fix one security issue and several bugs :

Security issue fixed :

  - Fix crashes on invalid input in IBM gconv modules     (CVE-2014-6040, CVE-2012-6656)

  - Fixed a stack overflow during hosts parsing     (CVE-2013-4357)

Bugs fixed :

  - don't touch user-controlled stdio locks in forked child     (bsc#864081, GLIBC BZ #12847)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

  - Add check for RTLD_DEEPBIND environment variable to     disable deepbinding of NSS modules (bsc#888860)

  - Fix infinite loop in check_pf (bsc#909053, GLIBC BZ     #12926)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and two additional issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#836746: Avoid race between {, __de}allocate_stack     and __reclaim_stacks during fork.

  - bnc#844309: Fixed various overflows, reading large     /etc/hosts or long names. (CVE-2013-4357)

  - bnc#894553, bnc#894556: Fixed various crashes on invalid     input in IBM gconv modules. (CVE-2014-6040,     CVE-2012-6656)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This glibc update fixes a critical privilege escalation problem and the following security and non-security issues :

  - bnc#892073: An off-by-one error leading to a heap-based     buffer overflow was found in __gconv_translit_find(). An     exploit that targets the problem is publicly available.
    (CVE-2014-5119)

  - bnc#882600: Copy filename argument in     posix_spawn_file_actions_addopen. (CVE-2014-4043)

  - bnc#860501: Use O_LARGEFILE for utmp file.

  - bnc#842291: Fix typo in     glibc-2.5-dlopen-lookup-race.diff.

  - bnc#839870: Fix integer overflows in malloc.
    (CVE-2013-4332)

  - bnc#834594: Fix readdir_r with long file names.
    (CVE-2013-4237)

  - bnc#824639: Drop lock before calling malloc_printerr.

  - bnc#801246: Fix buffer overrun in regexp matcher.
    (CVE-2013-0242)

  - bnc#779320: Fix buffer overflow in strcoll.
    (CVE-2012-4412)

  - bnc#894556 / bnc#894553: Fix crashes on invalid input in     IBM gconv modules. (CVE-2014-6040, CVE-2012-6656,     bnc#894553, bnc#894556, BZ#17325, BZ#14134)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of '0xffff' to the iconv function when converting IBM930 encoded data to UTF-8.
(CVE-2012-6656)

CVE-2012-6656

Fix validation check when converting from ibm930 to utf. When converting IBM930 code with iconv(), if IBM930 code which includes invalid multibyte character '0xffff' is specified, then iconv() segfaults.

CVE-2014-6040

Crashes on invalid input in IBM gconv modules [BZ #17325] These changes are based on the fix for BZ #14134 in commit 6e230d11837f3ae7b375ea69d7905f0d18eb79e5.

CVE-2014-7817

The function wordexp() fails to properly handle the WRDE_NOCMD flag when processing arithmetic inputs in the form of '$((... ``))' where '...' can be anything valid. The backticks in the arithmetic epxression are evaluated by in a shell even if WRDE_NOCMD forbade command substitution. This allows an attacker to attempt to pass dangerous commands via constructs of the above form, and bypass the WRDE_NOCMD flag. This patch fixes this by checking for WRDE_NOCMD in exec_comm(), the only place that can execute a shell. All other checks for WRDE_NOCMD are superfluous and removed.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201503-04 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A local attacker may be able to execute arbitrary code or cause a Denial       of Service condition,.
  Workaround :

    There is no known workaround at this time.

glibc has been updated to fix security issues and bugs :

  - Fix crashes on invalid input in IBM gconv modules.
    (CVE-2014-6040 / CVE-2012-6656, bsc#894553, bsc#894556,     GLIBC BZ #17325, GLIBC BZ #14134)

  - Avoid infinite loop in nss_dns getnetbyname.
    (CVE-2014-9402)

  - Don't touch user-controlled stdio locks in forked child.
    (bsc#864081, GLIBC BZ #12847)

  - Unlock mutex before going back to waiting for PI     mutexes. (bsc#891843, GLIBC BZ #14417)

  - Implement x86 cpuid handling of leaf4 for cache     information. (bsc#903288, GLIBC BZ #12587)

  - Fix infinite loop in check_pf. (bsc#909053, GLIBC BZ     #12926)

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library :

  - CVE-2015-0235     Qualys discovered that the gethostbyname and     gethostbyname2 functions were subject to a buffer     overflow if provided with a crafted IP address argument.
    This could be used by an attacker to execute arbitrary     code in processes which called the affected functions.

  The original glibc bug was reported by Peter Klotz.

  - CVE-2014-7817     Tim Waugh of Red Hat discovered that the WRDE_NOCMD     option of the wordexp function did not suppress command     execution in all cases. This allows a context-dependent     attacker to execute shell commands.

  - CVE-2012-6656 CVE-2014-6040     The charset conversion code for certain IBM multi-byte     code pages could perform an out-of-bounds array access,     causing the process to crash. In some scenarios, this     allows a remote attacker to cause a persistent denial of     service.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2432-1 advisory.

    Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when     using the iconv function. An attacker could possibly use this issue to cause applications to crash,     resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.
    (CVE-2012-6656)

    Adhemerval Zanella Netto discovered that the GNU C Library incorrectly handled certain multibyte     characters when using the iconv function. An attacker could possibly use this issue to cause applications     to crash, resulting in a denial of service. (CVE-2014-6040)

    Tim Waugh discovered that the GNU C Library incorrectly enforced the WRDE_NOCMD flag when handling the     wordexp function. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2014-7817)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities has been found and corrected in glibc :

When converting IBM930 code with iconv(), if IBM930 code which includes invalid multibyte character 0xffff is specified, then iconv() segfaults (CVE-2012-6656).

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules (CVE-2014-5119).

Crashes were reported in the IBM code page decoding functions (IBM933, IBM935, IBM937, IBM939, IBM1364) (CVE-2014-6040).

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
83675	SUSE SLES10 Security Update : glibc (SUSE-SU-2015:0170-1)	Nessus	SuSE Local Security Checks	high
83674	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0167-1)	Nessus	SuSE Local Security Checks	high
83673	SUSE SLES11 Security Update : glibc (SUSE-SU-2015:0164-1)	Nessus	SuSE Local Security Checks	high
83639	SUSE SLES11 Security Update : glibc (SUSE-SU-2014:1129-1)	Nessus	SuSE Local Security Checks	high
83638	SUSE SLES10 Security Update : glibc (SUSE-SU-2014:1128-1)	Nessus	SuSE Local Security Checks	high
82513	F5 Networks BIG-IP : GNU C Library (glibc) vulnerability (SOL16342)	Nessus	F5 Networks Local Security Checks	medium
82242	Debian DLA-97-1 : eglibc security update	Nessus	Debian Local Security Checks	medium
81689	GLSA-201503-04 : GNU C Library: Multiple vulnerabilities (GHOST)	Nessus	Gentoo Local Security Checks	high
81295	SuSE 11.3 Security Update : glibc (SAT Patch Number 10259)	Nessus	SuSE Local Security Checks	high
81029	Debian DSA-3142-1 : eglibc - security update	Nessus	Debian Local Security Checks	high
79718	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2432-1)	Nessus	Ubuntu Local Security Checks	high
77654	Mandriva Linux Security Advisory : glibc (MDVSA-2014:175)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2012-6656

high

Tenable Plugins

high

high

high

high

high

medium

medium

high

high

high

high

high