Debian DSA-2058-1 : glibc, eglibc - multiple vulnerabilities

High Nessus Plugin ID 46861

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the GNU C Library (aka glibc) and its derivatives. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2008-1391, CVE-2009-4880, CVE-2009-4881 Maksymilian Arciemowicz discovered that the GNU C library did not correctly handle integer overflows in the strfmon family of functions. If a user or automated system were tricked into processing a specially crafted format string, a remote attacker could crash applications, leading to a denial of service.

- CVE-2010-0296 Jeff Layton and Dan Rosenberg discovered that the GNU C library did not correctly handle newlines in the mntent family of functions. If a local attacker were able to inject newlines into a mount entry through other vulnerable mount helpers, they could disrupt the system or possibly gain root privileges.

- CVE-2010-0830 Dan Rosenberg discovered that the GNU C library did not correctly validate certain ELF program headers. If a user or automated system were tricked into verifying a specially crafted ELF program, a remote attacker could execute arbitrary code with user privileges.

Solution

Upgrade the glibc or eglibc packages.

For the stable distribution (lenny), these problems have been fixed in version 2.7-18lenny4 of the glibc package.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583908

https://security-tracker.debian.org/tracker/CVE-2008-1391

https://security-tracker.debian.org/tracker/CVE-2009-4880

https://security-tracker.debian.org/tracker/CVE-2009-4881

https://security-tracker.debian.org/tracker/CVE-2010-0296

https://security-tracker.debian.org/tracker/CVE-2010-0830

https://www.debian.org/security/2010/dsa-2058

Plugin Details

Severity: High

ID: 46861

File Name: debian_DSA-2058.nasl

Version: 1.10

Type: local

Agent: unix

Published: 2010/06/11

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:eglibc, p-cpe:/a:debian:debian_linux:glibc, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/06/10

Reference Information

CVE: CVE-2008-1391, CVE-2009-4880, CVE-2009-4881, CVE-2010-0296, CVE-2010-0830

BID: 36443, 40063

DSA: 2058

CWE: 189