Ubuntu 10.04 LTS : eglibc regression (USN-2306-2)

Ubuntu Security Notice (C) 2014-2016 Canonical, Inc. / NASL script (C) 2014-2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing a security-related patch.

Description :

USN-2306-1 fixed vulnerabilities in the GNU C Library. On Ubuntu 10.04
LTS, the security update cause a regression in certain environments
that use the Name Service Caching Daemon (nscd), such as those
configured for LDAP or MySQL authentication. In these environments,
the nscd daemon may need to be stopped manually for name resolution to
resume working so that updates can be downloaded, including
environments configured for unattended updates.

We apologize for the inconvenience.

Maksymilian Arciemowicz discovered that the GNU C Library incorrectly
handled the getaddrinfo() function. An attacker could use this issue
to cause a denial of service. This issue only affected Ubuntu 10.04
LTS. (CVE-2013-4357)

It was discovered that the GNU C Library incorrectly handled
the getaddrinfo() function. An attacker could use this issue
to cause a denial of service. This issue only affected
Ubuntu 10.04 LTS and Ubuntu 12.04 LTS. (CVE-2013-4458)

Stephane Chazelas discovered that the GNU C Library
incorrectly handled locale environment variables. An
attacker could use this issue to possibly bypass certain
restrictions such as the ForceCommand restrictions in
OpenSSH. (CVE-2014-0475)

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered that
the GNU C Library incorrectly handled
posix_spawn_file_actions_addopen() path arguments. An
attacker could use this issue to cause a denial of service.
(CVE-2014-4043).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libc6 package.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 6.5
(CVSS2#E:ND/RL:OF/RC:C)
Public Exploit Available : true

Family: Ubuntu Local Security Checks

Nessus Plugin ID: 77019 ()

Bugtraq ID: 63299
67992
68006
68505

CVE ID: CVE-2013-4357
CVE-2013-4458
CVE-2014-0475
CVE-2014-4043

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now