pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.

The remote NewStart CGSL host, running version MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

  - elf/dl-load.c in ld.so in the GNU C Library (aka glibc     or libc6) through 2.11.2, and 2.12.x through 2.12.1,     does not properly handle a value of $ORIGIN for the     LD_AUDIT environment variable, which allows local users     to gain privileges via a crafted dynamic shared object     (DSO) located in an arbitrary directory. (CVE-2010-3847)

  - ld.so in the GNU C Library (aka glibc or libc6) before     2.11.3, and 2.12.x before 2.12.2, does not properly     restrict use of the LD_AUDIT environment variable to     reference dynamic shared objects (DSOs) as audit     objects, which allows local users to gain privileges by     leveraging an unsafe DSO located in a trusted library     directory, as demonstrated by libpcprofile.so.
    (CVE-2010-3856)

  - Integer overflow in string/strcoll_l.c in the GNU C     Library (aka glibc or libc6) 2.17 and earlier allows     context-dependent attackers to cause a denial of service     (crash) or possibly execute arbitrary code via a long     string, which triggers a heap-based buffer overflow.
    (CVE-2012-4412)

  - Stack-based buffer overflow in string/strcoll_l.c in the     GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via a     long string that triggers a malloc failure and use of     the alloca function. (CVE-2012-4424)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide specially-     crafted input that, when processed, would cause the     application to crash. (CVE-2013-0242)

  - It was found that getaddrinfo() did not limit the amount     of stack memory used during name resolution. An attacker     able to make an application resolve an attacker-     controlled hostname or IP address could possibly cause     the application to exhaust all stack memory and crash.
    (CVE-2013-1914, CVE-2013-4458)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on the     files and obtain access to arbitrary pseudo-terminals by     leveraging a FUSE file system. (CVE-2013-2207)

  - An out-of-bounds write flaw was found in the way the     glibc's readdir_r() function handled file system entries     longer than the NAME_MAX character constant. A remote     attacker could provide a specially crafted NTFS or CIFS     file system that, when processed by an application using     readdir_r(), would cause that application to crash or,     potentially, allow the attacker to execute arbitrary     code with the privileges of the user running the     application. (CVE-2013-4237)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory allocator     functions (pvalloc, valloc, and memalign). If an     application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application. (CVE-2013-4332)

  - The PTR_MANGLE implementation in the GNU C Library (aka     glibc or libc6) 2.4, 2.17, and earlier, and Embedded     GLIBC (EGLIBC) does not initialize the random value for     the pointer guard, which makes it easier for context-     dependent attackers to control execution flow by     leveraging a buffer-overflow vulnerability in an     application and using the known zero value pointer guard     to calculate a pointer address. (CVE-2013-4788)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution.(CVE-2015-8778)

  - A stack-based buffer overflow was found in the way the     libresolv library performed dual A/AAAA DNS queries. A     remote attacker could create a specially crafted DNS     response which could cause libresolv to crash or,     potentially, execute code with the permissions of the     user running the library. Note: this issue is only     exposed when libresolv is called from the nss_dns NSS     service module.(CVE-2015-7547)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide     specially-crafted input that, when processed, would     cause the application to crash.(CVE-2013-0242)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is glibc-side mitigation which blocks     processing of LD_LIBRARY_PATH for programs running in     secure-execution mode and reduces the number of     allocations performed by the processing of LD_AUDIT,     LD_PRELOAD, and LD_HWCAP_MASK, making successful     exploitation of this issue more     difficult.(CVE-2017-1000366)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

  - It was found that the files back end of Name Service     Switch (NSS) did not isolate iteration over an entire     database from key-based look-up API calls. An     application performing look-ups on a database while     iterating over it could enter an infinite loop, leading     to a denial of service.(CVE-2014-8121)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library     (aka glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code     execution.(CVE-2018-1000001)

  - Stack-based buffer overflow in string/strcoll_l.c in     the GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string that triggers a malloc failure and use of     the alloca function.(CVE-2012-4424)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-8777)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~     operator.(CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on     the files and obtain access to arbitrary     pseudo-terminals by leveraging a FUSE file     system.(CVE-2013-2207)

  - A stack overflow flaw was found in glibc's swscanf()     function. An attacker able to make an application call     the swscanf() function could use this flaw to crash     that application or, potentially, execute arbitrary     code with the permissions of the user running the     application.(CVE-2015-1473)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-4458)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory     allocator functions (pvalloc, valloc, and memalign). If     an application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application.(CVE-2013-4332)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code.(CVE-2015-8779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory.

    Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty     files. A local attacker could use this to gain administrative privileges or expose sensitive information.
    (CVE-2013-2207, CVE-2016-2856)

    Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not     properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite     loop). (CVE-2014-8121)

    Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions     returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service     (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

    Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly     account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2015-1781)

    Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C     Library did not handle long lines in the files databases correctly. A local attacker could use this to     cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

    Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-     range argument data. An attacker could use this to cause a denial of service (application crash) or     possibly expose sensitive information. (CVE-2015-8776)

    Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection     mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege     boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
    (CVE-2015-8777)

    Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size     argument, leading to an integer overflow. An attacker could use to cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2015-8778)

    Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C     Library when handling long catalog names. An attacker could use this to cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

    Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly     handle long names passed as arguments. An attacker could use to cause a denial of service (stack     exhaustion leading to an application crash). (CVE-2016-3075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for glibc fixes the following issues :

  - CVE-2015-7547: A stack-based buffer overflow in     getaddrinfo allowed remote attackers to cause a crash or     execute arbitrary code via crafted and timed DNS     responses (bsc#961721)

  - CVE-2015-8777: Insufficient checking of LD_POINTER_GUARD     environment variable allowed local attackers to bypass     the pointer guarding protection of the dynamic loader on     set-user-ID and set-group-ID programs (bsc#950944)

  - CVE-2015-8776: Out-of-range time values passed to the     strftime function may cause it to crash, leading to a     denial of service, or potentially disclosure information     (bsc#962736)

  - CVE-2015-8778: Integer overflow in hcreate and hcreate_r     could have caused an out-of-bound memory access. leading     to application crashes or, potentially, arbitrary code     execution (bsc#962737)

  - CVE-2014-9761: A stack overflow (unbounded alloca) could     have caused applications which process long strings with     the nan function to crash or, potentially, execute     arbitrary code. (bsc#962738)

  - CVE-2015-8779: A stack overflow (unbounded alloca) in     the catopen function could have caused applications     which pass long strings to the catopen function to crash     or, potentially execute arbitrary code. (bsc#962739)

  - CVE-2013-2207: pt_chown tricked into granting access to     another users pseudo-terminal (bsc#830257)

  - CVE-2013-4458: Stack (frame) overflow in getaddrinfo()     when called with AF_INET6 (bsc#847227)

  - CVE-2014-8121: denial of service issue in the NSS     backends (bsc#918187)

  - bsc#920338: Read past end of pattern in fnmatch

  - CVE-2015-1781: buffer overflow in nss_dns (bsc#927080)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for glibc provides fixes for security and non-security issues.

These security issues have been fixed :

  - CVE-2015-1781: Buffer length after padding in     resolv/nss_dns/dns-host.c. (bsc#927080)

  - CVE-2013-2207: pt_chown did not properly check     permissions for tty files, which allowed local users to     change the permission on the files and obtain access to     arbitrary pseudo-terminals by leveraging a FUSE file     system. (bsc#830257)

  - CVE-2014-8121: DB_LOOKUP in the Name Service Switch     (NSS) did not properly check if a file is open, which     allowed remote attackers to cause a denial of service     (infinite loop) by performing a look-up while the     database is iterated over the database, which triggers     the file pointer to be reset. (bsc#918187)

  - Fix read past end of pattern in fnmatch. (bsc#920338)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201503-04 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A local attacker may be able to execute arbitrary code or cause a Denial       of Service condition,.
  Workaround :

    There is no known workaround at this time.

This update fixes the following issues in glibc :

  - CVE-2012-4412: glibc: buffer overflow in strcoll

  - CVE-2013-0242: glibc: DoS due to a buffer overrun in     regexp matcher by processing multibyte characters

  - CVE-2013-1914: glibc: stack overflow in getaddrinfo()     sorting

  - CVE-2013-2207: glibc: pt_chown tricked into granting     access to another users pseudo-terminal

  - CVE-2013-4237: glibc: Buffer overwrite - NAME_MAX not     enforced by readdir_r()

  - bnc#805054: man 1 locale mentions non-existent file

  - bnc#813306: glibc 2.17 fprintf(stderr, ...) triggers     write of undefined values if stderr is closed

  - bnc#819383: pldd a process multiple times can freeze the     process

  - bnc#819524: nscd segfault

  - bnc#824046: glibc: blacklist code in bindresvport     doesn't release lock, results in double-lock

  - bnc#839870: glibc: three integer overflows in memory     allocator

  - ARM: Support loading unmarked objects from cache

Updated glibc packages fixes the following security issues :

Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow (CVE-2012-4412).

Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function (CVE-2012-4424).

pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system (CVE-2013-2207).
NOTE! This is fixed by removing pt_chown wich may break chroots if their devpts was not mounted correctly (make sure to mount the devpts correctly with gid=5).

sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image (CVE-2013-4237).

Multiple integer overflows in malloc/malloc.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the (1) pvalloc, (2) valloc, (3) posix_memalign, (4) memalign, or (5) aligned_alloc functions (CVE-2013-4332).

A stack (frame) overflow flaw, which led to a denial of service (application crash), was found in the way glibc's getaddrinfo() function processed certain requests when called with AF_INET6. A similar flaw to CVE-2013-1914, this affects AF_INET6 rather than AF_UNSPEC (CVE-2013-4458).

The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context- dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address (CVE-2013-4788).

Other fixes in this update :

  - Correct the processing of '\x80' characters in     crypt_freesec.c

    - fix typo in nscd.service

glibc security update :

CVE-2013-2207 glibc (pt_chown): Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal

The fix may break chroots if their devpts was not mounted correctly.
Fix is to mount the devpts correctly with gid=5.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

glibc security update :

CVE-2012-4412 glibc: strcoll() integer overflow leading to buffer overflow CVE-2012-4424 glibc: alloca() stack overflow in the strcoll() interface CVE-2013-1914 glibc: Stack (frame) overflow in getaddrinfo() when processing entry mapping to long list of address structures CVE-2013-2207 glibc (pt_chown): Improper pseudotty ownership and permissions changes when granting access to the slave pseudoterminal CVE-2013-4237 glibc: Buffer overwrite when using readdir_r on file systems returning file names longer than NAME_MAX characters

Fix for CVE-2013-2207 may break chroots if their devpts was not mounted correctly. Fix is to mount the devpts correctly with gid=5.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
127161	NewStart CGSL MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2019-0012)	Nessus	NewStart CGSL Local Security Checks	Local	high
125004	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1551)	Nessus	Huawei Local Security Checks	Local	critical
91334	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	Local	critical
88831	SUSE SLES11 Security Update : glibc (SUSE-SU-2016:0470-1)	Nessus	SuSE Local Security Checks	Local	critical
85624	SUSE SLED11 / SLES11 Security Update : glibc (SUSE-SU-2015:1424-1)	Nessus	SuSE Local Security Checks	Local	medium
81689	GLSA-201503-04 : GNU C Library: Multiple vulnerabilities (GHOST)	Nessus	Gentoo Local Security Checks	Local	high
75154	openSUSE Security Update : glibc (openSUSE-SU-2013:1510-1)	Nessus	SuSE Local Security Checks	Local	high
71092	Mandriva Linux Security Advisory : glibc (MDVSA-2013:283)	Nessus	Mandriva Local Security Checks	Local	high
69784	Fedora 18 : glibc-2.16-34.fc18 (2013-15072)	Nessus	Fedora Local Security Checks	Local	low
69436	Fedora 19 : glibc-2.17-13.fc19 (2013-15053)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2013-2207

high

Tenable Plugins

high

critical

critical

critical

medium

high

high

high

low

high