NewStart CGSL CORE 5.04 / MAIN 5.04 : glibc Multiple Vulnerabilities (NS-SA-2021-0095)

low Nessus Plugin ID 154607

Language:

Synopsis

The remote NewStart CGSL host is affected by multiple vulnerabilities.

Description

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has glibc packages installed that are affected by multiple vulnerabilities:

- The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after- free vulnerabilities. (CVE-2014-4043)

- In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep. (CVE-2018-20796)

- On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program. (CVE-2019-19126)

- The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi- byte input sequences in the EUC-KR encoding, may have a buffer over-read. (CVE-2019-25013)

- The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

- sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack- based buffer overflow if the input to any of the printf family of functions is an 80-bit long double with a non-canonical bit pattern, as seen when passing a \x00\x04\x00\x00\x00\x00\x00\x00\x00\x04 value to sprintf. NOTE: the issue does not affect glibc by default in 2016 or later (i.e., 2.23 or later) because of commits made in 2015 for inlining of C99 math functions through use of GCC built-ins. In other words, the reference to 2.23 is intentional despite the mention of Fixed for glibc 2.33 in the 26649 reference.
(CVE-2020-29573)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade the vulnerable CGSL glibc packages. Note that updated packages may not be available yet. Please contact ZTE for more information.

Plugin Details

Severity: Low

ID: 154607

File Name: newstart_cgsl_NS-SA-2021-0095_glibc.nasl

Version: 1.4

Type: local

Family: NewStart CGSL Local Security Checks

Published: 10/28/2021

Updated: 5/9/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2014-4043

CVSS v3

Risk Factor: Low

Base Score: 3.3

Temporal Score: 3

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2019-19126

Vulnerability Information

CPE: p-cpe:/a:zte:cgsl_core:glibc, p-cpe:/a:zte:cgsl_core:glibc-common, p-cpe:/a:zte:cgsl_core:glibc-debuginfo, p-cpe:/a:zte:cgsl_core:glibc-debuginfo-common, p-cpe:/a:zte:cgsl_core:glibc-devel, p-cpe:/a:zte:cgsl_core:glibc-headers, p-cpe:/a:zte:cgsl_core:glibc-i18n, p-cpe:/a:zte:cgsl_core:glibc-iconv, p-cpe:/a:zte:cgsl_core:glibc-lang, p-cpe:/a:zte:cgsl_core:glibc-locale, p-cpe:/a:zte:cgsl_core:glibc-static, p-cpe:/a:zte:cgsl_core:glibc-tools, p-cpe:/a:zte:cgsl_core:glibc-utils, p-cpe:/a:zte:cgsl_core:nscd, p-cpe:/a:zte:cgsl_main:glibc, p-cpe:/a:zte:cgsl_main:glibc-common, p-cpe:/a:zte:cgsl_main:glibc-debuginfo, p-cpe:/a:zte:cgsl_main:glibc-debuginfo-common, p-cpe:/a:zte:cgsl_main:glibc-devel, p-cpe:/a:zte:cgsl_main:glibc-headers, p-cpe:/a:zte:cgsl_main:glibc-static, p-cpe:/a:zte:cgsl_main:glibc-utils, p-cpe:/a:zte:cgsl_main:nscd, cpe:/o:zte:cgsl_core:5, cpe:/o:zte:cgsl_main:5

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/ZTE-CGSL/release, Host/ZTE-CGSL/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/24/2021

Vulnerability Publication Date: 6/11/2014

Reference Information

CVE: CVE-2014-4043, CVE-2018-20796, CVE-2019-19126, CVE-2019-25013, CVE-2020-10029, CVE-2020-29573

Detections

Analytics