Ubuntu 12.04 LTS / 14.04 LTS / 15.10 : eglibc, glibc regression (USN-2985-2)

Ubuntu Security Notice (C) 2016 Canonical, Inc. / NASL script (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote Ubuntu host is missing one or more security-related
patches.

Description :

USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for
CVE-2014-9761 introduced a regression which affected applications that
use the libm library but were not fully restarted after the upgrade.
This update removes the fix for CVE-2014-9761 and a future update will
be provided to address this issue.

We apologize for the inconvenience.

Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use
this to gain administrative privileges or expose sensitive
information. (CVE-2013-2207, CVE-2016-2856)

Robin Hack discovered that the Name Service Switch (NSS)
implementation in the GNU C Library did not properly manage
its file descriptors. An attacker could use this to cause a
denial of service (infinite loop). (CVE-2014-8121)

Joseph Myers discovered that the GNU C Library did not
properly handle long arguments to functions returning a
representation of Not a Number (NaN). An attacker could use
this to cause a denial of service (stack exhaustion leading
to an application crash) or possibly execute arbitrary code.
(CVE-2014-9761)

Arjun Shankar discovered that in certain situations the
nss_dns code in the GNU C Library did not properly account
buffer sizes when passed an unaligned buffer. An attacker
could use this to cause a denial of service or possibly
execute arbitrary code. (CVE-2015-1781)

Sumit Bose and Lukas Slebodnik discovered that the Name
Service Switch (NSS) implementation in the GNU C Library did
not handle long lines in the files databases correctly. A
local attacker could use this to cause a denial of service
(application crash) or possibly execute arbitrary code.
(CVE-2015-5277)

Adam Nielsen discovered that the strftime function in the
GNU C Library did not properly handle out-of-range argument
data. An attacker could use this to cause a denial of
service (application crash) or possibly expose sensitive
information. (CVE-2015-8776)

Hector Marco and Ismael Ripoll discovered that the GNU C
Library allowed the pointer-guarding protection mechanism to
be disabled by honoring the LD_POINTER_GUARD environment
variable across privilege boundaries. A local attacker could
use this to exploit an existing vulnerability more easily.
(CVE-2015-8777)

Szabolcs Nagy discovered that the hcreate functions in the
GNU C Library did not properly check its size argument,
leading to an integer overflow. An attacker could use to
cause a denial of service (application crash) or possibly
execute arbitrary code. (CVE-2015-8778)

Maksymilian Arciemowicz discovered a stack-based buffer
overflow in the catopen function in the GNU C Library when
handling long catalog names. An attacker could use this to
cause a denial of service (application crash) or possibly
execute arbitrary code. (CVE-2015-8779)

Florian Weimer discovered that the getnetbyname
implementation in the GNU C Library did not properly handle
long names passed as arguments. An attacker could use to
cause a denial of service (stack exhaustion leading to an
application crash). (CVE-2016-3075).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

Solution :

Update the affected libc-bin, libc6 and / or libc6-dev packages.

Risk factor :

High / CVSS Base Score : 7.5
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS Temporal Score : 5.9
(CVSS2#E:POC/RL:OF/RC:ND)
Public Exploit Available : true

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now