Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : eglibc, glibc vulnerabilities (USN-2985-1)

Ubuntu Security Notice (C) 2016 Canonical, Inc. / NASL script (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use
this to gain administrative privileges or expose sensitive
information. (CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS)
implementation in the GNU C Library did not properly manage its file
descriptors. An attacker could use this to cause a denial of service
(infinite loop). (CVE-2014-8121)

Joseph Myers discovered that the GNU C Library did not properly handle
long arguments to functions returning a representation of Not a Number
(NaN). An attacker could use this to cause a denial of service (stack
exhaustion leading to an application crash) or possibly execute
arbitrary code. (CVE-2014-9761)

Arjun Shankar discovered that in certain situations the nss_dns code
in the GNU C Library did not properly account buffer sizes when passed
an unaligned buffer. An attacker could use this to cause a denial of
service or possibly execute arbitrary code. (CVE-2015-1781)

Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch
(NSS) implementation in the GNU C Library did not handle long lines in
the files databases correctly. A local attacker could use this to
cause a denial of service (application crash) or possibly execute
arbitrary code. (CVE-2015-5277)

Adam Nielsen discovered that the strftime function in the GNU C
Library did not properly handle out-of-range argument data. An
attacker could use this to cause a denial of service (application
crash) or possibly expose sensitive information. (CVE-2015-8776)

Hector Marco and Ismael Ripoll discovered that the GNU C Library
allowed the pointer-guarding protection mechanism to be disabled by
honoring the LD_POINTER_GUARD environment variable across privilege
boundaries. A local attacker could use this to exploit an existing
vulnerability more easily. (CVE-2015-8777)

Szabolcs Nagy discovered that the hcreate functions in the GNU C
Library did not properly check its size argument, leading to an
integer overflow. An attacker could use to cause a denial of service
(application crash) or possibly execute arbitrary code.
(CVE-2015-8778)

Maksymilian Arciemowicz discovered a stack-based buffer overflow in
the catopen function in the GNU C Library when handling long catalog
names. An attacker could use this to cause a denial of service
(application crash) or possibly execute arbitrary code.
(CVE-2015-8779)

Florian Weimer discovered that the getnetbyname implementation in the
GNU C Library did not properly handle long names passed as arguments.
An attacker could use to cause a denial of service (stack exhaustion
leading to an application crash). (CVE-2016-3075).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libc6 and / or libc6-dev packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now