Avoid unbound alloca in vfprintf (#841318)

Revert patch for BZ696143, it made it impossible to use IPV6 addresses explicitly in getaddrinfo, which in turn broke ssh, apache and other code. (#808147)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1589-1 fixed vulnerabilities in the GNU C Library. One of the updates exposed a regression in the floating point parser. This update fixes the problem.

We apologize for the inconvenience.

It was discovered that positional arguments to the printf() family of functions were not handled properly in the GNU C Library. An attacker could possibly use this to cause a stack-based buffer overflow, creating a denial of service or possibly execute arbitrary code.
(CVE-2012-3404, CVE-2012-3405, CVE-2012-3406)

It was discovered that multiple integer overflows existed in the strtod(), strtof() and strtold() functions in the GNU C Library. An attacker could possibly use this to trigger a stack-based buffer overflow, creating a denial of service or possibly execute arbitrary code. (CVE-2012-3480).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated glibc packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The glibc packages provide the standard C and standard math libraries used by multiple programs on the system. Without these libraries, the Linux system cannot function properly.

It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca(). This could allow an attacker to bypass FORTIFY_SOURCE protections and execute arbitrary code using a format string flaw in an application, even though these protections are expected to limit the impact of such flaws to an application abort. (CVE-2012-3406)

This update also fixes the following bug :

* If a file or a string was in the IBM-930 encoding, and contained the invalid multibyte character '0xffff', attempting to use iconv() (or the iconv command) to convert that file or string to another encoding, such as UTF-8, resulted in a segmentation fault. With this update, the conversion code for the IBM-930 encoding recognizes this invalid character and calls an error handler, rather than causing a segmentation fault. (BZ#837896)

All users of glibc are advised to upgrade to these updated packages, which contain backported patches to fix these issues.

This collective update for the GNU C library (glibc) provides the following fixes and enhancements :

Security issues fixed :

  - Fix stack overflow in getaddrinfo with many results.
    (bnc#813121, CVE-2013-1914)

  - Fix a different stack overflow in getaddrinfo with many     results. (bnc#828637)

  - Fix array overflow in floating point parser [bnc#775690]     (CVE-2012-3480)

  - Fix strtod integer/buffer overflows [bnc#775690]     (CVE-2012-3480)

  - Add patches for fix overflows in vfprintf. [bnc #770891,     CVE-2012-3405, CVE-2012-3406]

  - Fix buffer overflow in glob. (bnc#691365)     (CVE-2010-4756)

  - Flush stream in addmntent, to catch errors like reached     file size limits. [bnc #676178, CVE-2011-1089]

Bugs fixed :

  - Fix locking in _IO_cleanup. (bnc#796982)

  - Fix resolver when first query fails, but seconds     succeeds. [bnc #767266]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201503-04 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A local attacker may be able to execute arbitrary code or cause a Denial       of Service condition,.
  Workaround :

    There is no known workaround at this time.

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-695:04 advisory.

    The glibc package contains standard libraries which are used by multiple programs on the system. In order     to save disk space and memory, as well as to make upgrading easier, common system code is kept in one     place and shared between programs. This particular package contains the most important sets of shared     libraries: the standard C library and the standard math library. Without these two libraries, a Linux     system will not function.
    Security issues fixed with this release:
     CVE-2012-3406     No description available at the time of writing, please refer to the CVE link below.
    Fixed bugs:
     Fixed iconv() segfault if the invalid multibyte character 0xffff is in the input (file or string) when     converting from IBM930 .

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library :

  - CVE-2012-3406     The vfprintf function in stdio-common/vfprintf.c in GNU     C Library (aka glibc) 2.5, 2.12, and probably other     versions does not 'properly restrict the use of' the     alloca function when allocating the SPECS array, which     allows context-dependent attackers to bypass the     FORTIFY_SOURCE format-string protection mechanism and     cause a denial of service (crash) or possibly execute     arbitrary code via a crafted format string using     positional parameters and a large number of format     specifiers, a different vulnerability than CVE-2012-3404     and CVE-2012-3405.

  - CVE-2013-7424     An invalid free flaw was found in glibc's getaddrinfo()     function when used with the AI_IDN flag. A remote     attacker able to make an application call this function     could use this flaw to execute arbitrary code with the     permissions of the user running the application. Note     that this flaw only affected applications using glibc     compiled with libidn support.

  - CVE-2014-4043     The posix_spawn_file_actions_addopen function in glibc     before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows     context-dependent attackers to trigger use-after-free     vulnerabilities.

  - CVE-2014-9402     The getnetbyname function in glibc 2.21 or earlier will     enter an infinite loop if the DNS backend is activated     in the system Name Service Switch configuration, and the     DNS resolver receives a positive answer while processing     the network name.

  - CVE-2015-1472 / CVE-2015-1473     Under certain conditions wscanf can allocate too little     memory for the to-be-scanned arguments and overflow the     allocated buffer. The incorrect use of     '__libc_use_alloca (newsize)' caused a different (and     weaker) policy to be enforced which could allow a denial     of service attack.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1097 advisory.

    [2.5-81.el5_8.4]
    - Fix iconv() segfault if the invalid multibyte character 0xffff is input when converting from IBM930     (#837896)

    [2.5-81.el5_8.3]
    - Fix unbound alloca in vfprintf (#833720)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-1098 advisory.

    [2.12-1.80.el6_3.3]
    - Fix incorrect/corrupt patchfile for 833716.  Did not         affect generated code, but tests were missing (#833716).

    [2.12-1.80.el6_3.2]
    - Fix regression after patch for BZ804630 (#837026).

    [2.12-1.80.el6_3.1]
    - Fixes an unbound alloca and related problems. (#833716)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The glibc packages provide the standard C and standard math libraries used by multiple programs on the system. Without these libraries, the Linux system cannot function properly.

It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca(). This could allow an attacker to bypass FORTIFY_SOURCE protections and execute arbitrary code using a format string flaw in an application, even though these protections are expected to limit the impact of such flaws to an application abort. (CVE-2012-3406)

This update also fixes the following bug :

  - If a file or a string was in the IBM-930 encoding, and     contained the invalid multibyte character '0xffff',     attempting to use iconv() (or the iconv command) to     convert that file or string to another encoding, such as     UTF-8, resulted in a segmentation fault. With this     update, the conversion code for the IBM-930 encoding     recognizes this invalid character and calls an error     handler, rather than causing a segmentation fault.

All users of glibc are advised to upgrade to these updated packages, which contain backported patches to fix these issues.

The remote VMware ESXi 5.0 host is affected by Multiple Vulnerabilities :

  - An integer overflow condition exists in the
    __tzfile_read() function in the glibc library. An     unauthenticated, remote attacker can exploit this, via     a crafted timezone (TZ) file, to cause a denial of     service or the execution of arbitrary code.
    (CVE-2009-5029)

  - ldd in the glibc library is affected by a privilege     escalation vulnerability due to the omission of certain     LD_TRACE_LOADED_OBJECTS checks in a crafted executable     file. Note that this vulnerability is disputed by the     library vendor. (CVE-2009-5064)

  - A remote code execution vulnerability exists in the     glibc library due to an integer signedness error in the     elf_get_dynamic_info() function when the '--verify'     option is used. A remote attacker can exploit this by     using a crafted ELF program with a negative value for a     certain d_tag structure member in the ELF header.
    (CVE-2010-0830)

  - A flaw exists in OpenSSL due to a failure to properly     prevent modification of the ciphersuite in the session     cache when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is     enabled. A remote attacker can exploit this to force a     downgrade to an unintended cipher by intercepting the     network traffic to discover a session identifier.
    (CVE-2010-4180)

  - A flaw exists in OpenSSL due to a failure to properly     validate the public parameters in the J-PAKE protocol     when J-PAKE is enabled. A remote attacker can exploit     this, by sending crafted values in each round of the     protocol, to bypass the need for knowledge of the shared     secret. (CVE-2010-4252)

  - A out-of-bounds memory error exists in OpenSSL that     allows a remote attacker to cause a denial of service or     possibly obtain sensitive information by using a     malformed ClientHello handshake message. This is also     known as the 'OCSP stapling vulnerability'.
    (CVE-2011-0014)

  - A flaw exists in the addmntent() function in the glibc     library due to a failure to report the error status for     failed attempts to write to the /etc/mtab file. A local     attacker can exploit this to corrupt the file by using     writes from a process with a small RLIMIT_FSIZE value.
    (CVE-2011-1089)

  - A flaw exists in the png_set_text_2() function in the     file pngset.c in the libpng library due to a failure to     properly allocate memory. An unauthenticated, remote     attacker can exploit this, via a crafted text chunk in a     PNG image file, to trigger a heap-based buffer overflow,     resulting in denial of service or the execution of     arbitrary code. (CVE-2011-3048)

  - A flaw exists in the DTLS implementation in OpenSSL due     to performing a MAC check only if certain padding is     valid. A remote attacker can exploit this, via a padding     oracle attack, to recover the plaintext. (CVE-2011-4108)

  - A double-free error exists in OpenSSL when the     X509_V_FLAG_POLICY_CHECK is enabled. A remote attacker     can exploit this by triggering a policy check failure,     resulting in an unspecified impact. (CVE-2011-4109)

  - A flaw exists in OpenSSL in the SSL 3.0 implementation     due to improper initialization of data structures used     for block cipher padding. A remote attacker can exploit     this, by decrypting the padding data sent by an SSL     peer, to obtain sensitive information. (CVE-2011-4576)

  - A denial of service vulnerability exists in OpenSSL when     RFC 3779 support is enabled. A remote attacker can     exploit this to cause an assertion failure, by using an     X.509 certificate containing certificate extension data     associated with IP address blocks or Autonomous System     (AS) identifiers. (CVE-2011-4577)

  - A denial of service vulnerability exists in the RPC     implementation in the glibc library due to a flaw in the     svc_run() function. A remote attacker can exploit this,     via large number of RPC connections, to exhaust CPU     resources. (CVE-2011-4609)

  - A denial of service vulnerability exists in the Server     Gated Cryptography (SGC) implementation in OpenSSL due     to a failure to properly handle handshake restarts. A     remote attacker can exploit this, via unspecified     vectors, to exhaust CPU resources. (CVE-2011-4619)

  - A denial of service vulnerability exists in OpenSSL due     to improper support of DTLS applications. A remote     attacker can exploit this, via unspecified vectors     related to an out-of-bounds read error. Note that this     vulnerability exists because of an incorrect fix for     CVE-2011-4108. (CVE-2012-0050)

  - A security bypass vulnerability exists in the glibc     library due to an integer overflow condition in the     vfprintf() function in file stdio-common/vfprintf.c. An     attacker can exploit this, by using a large number of     arguments, to bypass the FORTIFY_SOURCE protection     mechanism, allowing format string attacks or writing to     arbitrary memory. (CVE-2012-0864)

  - A denial of service vulnerability exists in the glibc     library in the vfprintf() function in file     stdio-common/vfprintf.c due to a failure to properly     calculate a buffer length. An attacker can exploit this,     via a format string that uses positional parameters and     many format specifiers, to bypass the FORTIFY_SOURCE     format-string protection mechanism, thus causing stack     corruption and a crash. (CVE-2012-3404)

  - A denial of service vulnerability exists in the glibc     library in the vfprintf() function in file     stdio-common/vfprintf.c due to a failure to properly     calculate a buffer length. An attacker can exploit this,     via a format string with a large number of format     specifiers, to bypass the FORTIFY_SOURCE format-string     protection mechanism, thus triggering desynchronization     within the buffer size handling, resulting in a     segmentation fault and crash. (CVE-2012-3405)

  - A flaw exists in the glibc library in the vfprintf()     function in file stdio-common/vfprintf.c due to a     failure to properly restrict the use of the alloca()     function when allocating the SPECS array. An attacker     can exploit this, via a crafted format string using     positional parameters and a large number of format     specifiers, to bypass the FORTIFY_SOURCE format-string     protection mechanism, thus triggering a denial of     service or the possible execution of arbitrary code.
    (CVE-2012-3406)

  - A flaw exists in the glibc library due to multiple     integer overflow conditions in the strtod(), strtof(),     strtold(), strtod_l(), and other unspecified related     functions. A local attacker can exploit these to trigger     a stack-based buffer overflow, resulting in an     application crash or the possible execution of arbitrary     code. (CVE-2012-3480)

  - A privilege escalation vulnerability exists in the     Virtual Machine Communication Interface (VMCI) due to a     failure by control code to properly restrict memory     allocation. A local attacker can exploit this, via     unspecified vectors, to gain privileges. (CVE-2013-1406)

  - An error exists in the implementation of the Network     File Copy (NFC) protocol. A man-in-the-middle attacker     can exploit this, by modifying the client-server data     stream, to cause a denial of service or the execution     of arbitrary code. (CVE-2013-1659)

This collective update to the GNU Lib C library (glibc) provides the following fixes :

  - Make addmntent() return errors also for cached streams     (bnc#676178, CVE-2011-1089)

  - Fix overflows in vfprintf() (bnc#770891, CVE-2012-3406)

  - Fix incomplete results from nscd (bnc#753756)

  - Fix a deadlock in dlsym in case the symbol isn't found,     for multi-threaded programs (bnc #760216).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
61556	Fedora 17 : glibc-2.15-54.fc17 (2012-11508)	Nessus	Fedora Local Security Checks	8/16/2012	1/11/2021	medium
63285	Ubuntu 8.04 LTS : glibc regression (USN-1589-2)	Nessus	Ubuntu Local Security Checks	12/18/2012	9/19/2019	medium
60057	RHEL 5 : glibc (RHSA-2012:1097)	Nessus	Red Hat Local Security Checks	7/19/2012	1/14/2021	medium
83594	SUSE SLES11 Security Update : glibc (SUSE-SU-2013:1251-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/19/2021	medium
81689	GLSA-201503-04 : GNU C Library: Multiple vulnerabilities (GHOST)	Nessus	Gentoo Local Security Checks	3/9/2015	1/11/2021	high
284305	MiracleLinux 3 : glibc-2.5-81.4.0.1.AXS3 (AXSA:2012-695:04)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
81448	Debian DSA-3169-1 : eglibc - security update	Nessus	Debian Local Security Checks	2/24/2015	1/11/2021	high
68582	Oracle Linux 5 : glibc (ELSA-2012-1097)	Nessus	Oracle Linux Local Security Checks	7/12/2013	11/1/2024	critical
68583	Oracle Linux 6 : glibc (ELSA-2012-1098)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	critical
61368	Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20120718)	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	medium
70885	ESXi 5.0 < Build 912577 Multiple Vulnerabilities (remote check)	Nessus	Misc.	11/13/2013	11/15/2018	high
83565	SUSE SLED10 / SLES10 Security Update : glibc (SUSE-SU-2012:1488-1)	Nessus	SuSE Local Security Checks	5/20/2015	1/19/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

critical

high

critical

critical

medium

high

medium