Debian DSA-2058-1 : glibc, eglibc - multiple vulnerabilities

High Nessus Plugin ID 46861

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the GNU C Library (aka glibc) and its derivatives. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2008-1391, CVE-2009-4880, CVE-2009-4881 Maksymilian Arciemowicz discovered that the GNU C library did not correctly handle integer overflows in the strfmon family of functions. If a user or automated system were tricked into processing a specially crafted format string, a remote attacker could crash applications, leading to a denial of service.

- CVE-2010-0296 Jeff Layton and Dan Rosenberg discovered that the GNU C library did not correctly handle newlines in the mntent family of functions. If a local attacker were able to inject newlines into a mount entry through other vulnerable mount helpers, they could disrupt the system or possibly gain root privileges.

- CVE-2010-0830 Dan Rosenberg discovered that the GNU C library did not correctly validate certain ELF program headers. If a user or automated system were tricked into verifying a specially crafted ELF program, a remote attacker could execute arbitrary code with user privileges.

Solution

Upgrade the glibc or eglibc packages.

For the stable distribution (lenny), these problems have been fixed in version 2.7-18lenny4 of the glibc package.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=583908

https://security-tracker.debian.org/tracker/CVE-2008-1391

https://security-tracker.debian.org/tracker/CVE-2009-4880

https://security-tracker.debian.org/tracker/CVE-2009-4881

https://security-tracker.debian.org/tracker/CVE-2010-0296

https://security-tracker.debian.org/tracker/CVE-2010-0830

https://www.debian.org/security/2010/dsa-2058

Plugin Details

Severity: High

ID: 46861

File Name: debian_DSA-2058.nasl

Version: 1.10

Type: local

Agent: unix

Published: 2010/06/11

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: High

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:eglibc, p-cpe:/a:debian:debian_linux:glibc, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/06/10

Reference Information

CVE: CVE-2008-1391, CVE-2009-4880, CVE-2009-4881, CVE-2010-0296, CVE-2010-0830

BID: 36443, 40063

DSA: 2058

CWE: 189