Amazon Linux 2：glibc (ALAS-2023-2221)
high Nessus 插件 ID 180079
语言：
简介
远程 Amazon Linux 2 主机缺少安全更新。描述
远程主机上安装的 glibc 版本低于 2.26-37。因此，它受到 ALAS2-2023-2221 公告中提及的多个漏洞影响。- 在 x86-64 架构中，2.31 之前的 GNU C 库（也称为 glibc）在安全转换后的程序执行过程中无法忽略 LD_PREFER_MAP_32BIT_EXEC 环境变量，本地攻击者可利用此漏洞，限制加载库的可能映射地址，从而绕过用于 setuid 程序的 ASLR。(CVE-2019-19126)
- 如果 80 位长双重函数的输入包含非规范位模式，如在将 0x5d414141414141410000 值传递至 x86 目标上的 sinl 时所见，2.32 之前的 GNU C 库（亦称 glibc 或 libc6）会在范围检查期间导致堆栈上的缓冲区溢出。这与 sysdeps/ieee754/ldbl-96/e_rem_pio2l.c 相关。(CVE-2020-10029)
- 在执行 tiltil 扩展期间，发现 glibc 上游版本 (2.14) 中引入了释放后使用漏洞。包含初始 tilde 且后跟有效用户名的目录路径受到此问题的影响。本地攻击者可通过创建特别构建的路径利用此缺陷，此文档可能会在经 glob 函数处理时，导致任意代码执行。此缺陷已在版本 2.32 中修复。(CVE-2020-1752)
请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。
解决方案
运行 'yum update glibc' 以更新系统。另见
https://alas.aws.amazon.com/AL2/ALAS-2023-2221.html
https://alas.aws.amazon.com/cve/html/CVE-2019-19126.html
https://alas.aws.amazon.com/cve/html/CVE-2020-10029.html
插件详情
严重性: High
ID: 180079
文件名: al2_ALAS-2023-2221.nasl
版本: 1.2
类型: local
代理: unix
发布时间: 2023/8/23
最近更新时间: 2024/12/11
支持的传感器: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
风险信息
VPR
风险因素: Medium
分数: 5.9
CVSS v2
风险因素: Low
基本分数: 3.7
时间分数: 2.9
矢量: CVSS2#AV:L/AC:H/Au:N/C:P/I:P/A:P
CVSS 分数来源: CVE-2020-1752
CVSS v3
风险因素: High
基本分数: 7
时间分数: 6.3
矢量: CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
时间矢量: CVSS:3.0/E:P/RL:O/RC:C
漏洞信息
CPE: p-cpe:/a:amazon:linux:libcrypt-nss, p-cpe:/a:amazon:linux:glibc-langpack-csb, p-cpe:/a:amazon:linux:glibc-langpack-sv, p-cpe:/a:amazon:linux:glibc-langpack-sa, p-cpe:/a:amazon:linux:glibc-langpack-hy, p-cpe:/a:amazon:linux:glibc-langpack-ar, p-cpe:/a:amazon:linux:glibc-langpack-ta, p-cpe:/a:amazon:linux:glibc-langpack-sl, p-cpe:/a:amazon:linux:glibc-langpack-ts, p-cpe:/a:amazon:linux:glibc-langpack-nan, p-cpe:/a:amazon:linux:glibc-langpack-ne, p-cpe:/a:amazon:linux:glibc-langpack-tl, p-cpe:/a:amazon:linux:glibc-debuginfo-common, p-cpe:/a:amazon:linux:glibc-langpack-niu, p-cpe:/a:amazon:linux:nscd, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:glibc-langpack-hu, p-cpe:/a:amazon:linux:glibc-langpack-hne, p-cpe:/a:amazon:linux:glibc-langpack-et, p-cpe:/a:amazon:linux:glibc-langpack-an, p-cpe:/a:amazon:linux:glibc-langpack-bg, p-cpe:/a:amazon:linux:glibc-langpack-mai, p-cpe:/a:amazon:linux:glibc-langpack-ug, p-cpe:/a:amazon:linux:glibc-langpack-mag, p-cpe:/a:amazon:linux:glibc-langpack-kk, p-cpe:/a:amazon:linux:glibc-langpack-oc, p-cpe:/a:amazon:linux:glibc-langpack-anp, p-cpe:/a:amazon:linux:glibc-langpack-lij, p-cpe:/a:amazon:linux:glibc-locale-source, p-cpe:/a:amazon:linux:glibc-langpack-fa, p-cpe:/a:amazon:linux:glibc-langpack-gv, p-cpe:/a:amazon:linux:glibc-langpack-ka, p-cpe:/a:amazon:linux:glibc-langpack-eo, p-cpe:/a:amazon:linux:glibc-langpack-ig, p-cpe:/a:amazon:linux:glibc-langpack-hsb, p-cpe:/a:amazon:linux:glibc-langpack-kn, p-cpe:/a:amazon:linux:glibc-langpack-shs, p-cpe:/a:amazon:linux:glibc-langpack-hr, p-cpe:/a:amazon:linux:glibc-langpack-ik, p-cpe:/a:amazon:linux:glibc-benchtests, p-cpe:/a:amazon:linux:glibc-langpack-it, p-cpe:/a:amazon:linux:glibc-langpack-chr, p-cpe:/a:amazon:linux:glibc-langpack-id, p-cpe:/a:amazon:linux:glibc-langpack-vi, p-cpe:/a:amazon:linux:glibc-langpack-sgs, p-cpe:/a:amazon:linux:glibc-langpack-cmn, p-cpe:/a:amazon:linux:glibc-langpack-bem, p-cpe:/a:amazon:linux:glibc-langpack-ku, p-cpe:/a:amazon:linux:glibc-nss-devel, p-cpe:/a:amazon:linux:glibc-langpack-hi, p-cpe:/a:amazon:linux:glibc-langpack-el, p-cpe:/a:amazon:linux:glibc-langpack-mk, p-cpe:/a:amazon:linux:glibc, p-cpe:/a:amazon:linux:glibc-langpack-brx, p-cpe:/a:amazon:linux:glibc-langpack-cs, p-cpe:/a:amazon:linux:glibc-langpack-quz, p-cpe:/a:amazon:linux:glibc-langpack-wal, p-cpe:/a:amazon:linux:glibc-langpack-ms, p-cpe:/a:amazon:linux:glibc-devel, p-cpe:/a:amazon:linux:glibc-langpack-doi, p-cpe:/a:amazon:linux:glibc-headers, p-cpe:/a:amazon:linux:glibc-langpack-en, p-cpe:/a:amazon:linux:glibc-langpack-st, p-cpe:/a:amazon:linux:glibc-langpack-nl, p-cpe:/a:amazon:linux:glibc-langpack-mr, p-cpe:/a:amazon:linux:glibc-langpack-yi, p-cpe:/a:amazon:linux:glibc-langpack-nhn, p-cpe:/a:amazon:linux:glibc-langpack-dv, p-cpe:/a:amazon:linux:glibc-langpack-eu, p-cpe:/a:amazon:linux:glibc-langpack-yue, p-cpe:/a:amazon:linux:glibc-langpack-my, p-cpe:/a:amazon:linux:glibc-langpack-bhb, p-cpe:/a:amazon:linux:glibc-langpack-ve, p-cpe:/a:amazon:linux:glibc-langpack-ce, p-cpe:/a:amazon:linux:glibc-langpack-ast, p-cpe:/a:amazon:linux:glibc-langpack-sid, p-cpe:/a:amazon:linux:glibc-langpack-ks, p-cpe:/a:amazon:linux:glibc-langpack-ti, p-cpe:/a:amazon:linux:glibc-langpack-sc, p-cpe:/a:amazon:linux:glibc-langpack-cv, p-cpe:/a:amazon:linux:glibc-static, p-cpe:/a:amazon:linux:glibc-langpack-ia, p-cpe:/a:amazon:linux:glibc-langpack-km, p-cpe:/a:amazon:linux:glibc-langpack-tig, p-cpe:/a:amazon:linux:glibc-langpack-nn, p-cpe:/a:amazon:linux:glibc-langpack-byn, p-cpe:/a:amazon:linux:glibc-langpack-crh, p-cpe:/a:amazon:linux:glibc-langpack-gl, p-cpe:/a:amazon:linux:glibc-langpack-bs, p-cpe:/a:amazon:linux:glibc-langpack-as, p-cpe:/a:amazon:linux:glibc-langpack-pa, p-cpe:/a:amazon:linux:glibc-langpack-mg, p-cpe:/a:amazon:linux:glibc-langpack-fr, p-cpe:/a:amazon:linux:glibc-langpack-nso, p-cpe:/a:amazon:linux:glibc-langpack-or, p-cpe:/a:amazon:linux:glibc-langpack-szl, p-cpe:/a:amazon:linux:glibc-langpack-nb, p-cpe:/a:amazon:linux:nss_nis, p-cpe:/a:amazon:linux:glibc-langpack-hak, p-cpe:/a:amazon:linux:glibc-langpack-dz, p-cpe:/a:amazon:linux:glibc-langpack-lzh, p-cpe:/a:amazon:linux:glibc-langpack-ha, p-cpe:/a:amazon:linux:glibc-langpack-nds, p-cpe:/a:amazon:linux:glibc-langpack-kl, p-cpe:/a:amazon:linux:glibc-langpack-aa, p-cpe:/a:amazon:linux:glibc-langpack-fil, p-cpe:/a:amazon:linux:glibc-langpack-ro, p-cpe:/a:amazon:linux:glibc-langpack-lo, p-cpe:/a:amazon:linux:glibc-langpack-cy, p-cpe:/a:amazon:linux:glibc-langpack-de, p-cpe:/a:amazon:linux:glibc-langpack-pt, p-cpe:/a:amazon:linux:glibc-langpack-kok, p-cpe:/a:amazon:linux:glibc-langpack-ur, p-cpe:/a:amazon:linux:glibc-langpack-unm, p-cpe:/a:amazon:linux:glibc-langpack-the, p-cpe:/a:amazon:linux:glibc-langpack-da, p-cpe:/a:amazon:linux:glibc-langpack-ayc, p-cpe:/a:amazon:linux:glibc-langpack-lt, p-cpe:/a:amazon:linux:glibc-langpack-lb, p-cpe:/a:amazon:linux:glibc-langpack-ml, p-cpe:/a:amazon:linux:glibc-langpack-ps, p-cpe:/a:amazon:linux:glibc-langpack-az, p-cpe:/a:amazon:linux:glibc-langpack-tcy, p-cpe:/a:amazon:linux:glibc-langpack-lv, p-cpe:/a:amazon:linux:glibc-langpack-si, p-cpe:/a:amazon:linux:glibc-langpack-ja, p-cpe:/a:amazon:linux:glibc-langpack-zh, p-cpe:/a:amazon:linux:glibc-langpack-tt, p-cpe:/a:amazon:linux:glibc-langpack-be, p-cpe:/a:amazon:linux:glibc-langpack-bn, p-cpe:/a:amazon:linux:glibc-langpack-ru, p-cpe:/a:amazon:linux:glibc-langpack-mt, p-cpe:/a:amazon:linux:glibc-langpack-ko, p-cpe:/a:amazon:linux:glibc-langpack-he, p-cpe:/a:amazon:linux:glibc-langpack-wae, p-cpe:/a:amazon:linux:glibc-langpack-ca, p-cpe:/a:amazon:linux:glibc-langpack-gez, p-cpe:/a:amazon:linux:glibc-langpack-is, p-cpe:/a:amazon:linux:glibc-langpack-mi, p-cpe:/a:amazon:linux:glibc-langpack-br, p-cpe:/a:amazon:linux:glibc-langpack-om, p-cpe:/a:amazon:linux:glibc-langpack-bo, p-cpe:/a:amazon:linux:glibc-langpack-uz, p-cpe:/a:amazon:linux:glibc-minimal-langpack, p-cpe:/a:amazon:linux:glibc-langpack-os, p-cpe:/a:amazon:linux:glibc-langpack-mni, p-cpe:/a:amazon:linux:glibc-langpack-mn, p-cpe:/a:amazon:linux:glibc-langpack-ln, p-cpe:/a:amazon:linux:glibc-langpack-ky, p-cpe:/a:amazon:linux:glibc-langpack-sd, p-cpe:/a:amazon:linux:glibc-debuginfo, p-cpe:/a:amazon:linux:glibc-langpack-gu, p-cpe:/a:amazon:linux:glibc-langpack-sw, p-cpe:/a:amazon:linux:glibc-langpack-iu, p-cpe:/a:amazon:linux:glibc-langpack-ss, p-cpe:/a:amazon:linux:glibc-langpack-sq, p-cpe:/a:amazon:linux:glibc-langpack-nr, p-cpe:/a:amazon:linux:nss_hesiod, p-cpe:/a:amazon:linux:glibc-langpack-bho, p-cpe:/a:amazon:linux:glibc-langpack-fo, p-cpe:/a:amazon:linux:glibc-langpack-tg, p-cpe:/a:amazon:linux:glibc-langpack-ak, p-cpe:/a:amazon:linux:glibc-langpack-se, p-cpe:/a:amazon:linux:glibc-langpack-mhr, p-cpe:/a:amazon:linux:glibc-langpack-zu, p-cpe:/a:amazon:linux:glibc-common, p-cpe:/a:amazon:linux:glibc-langpack-am, p-cpe:/a:amazon:linux:glibc-langpack-es, p-cpe:/a:amazon:linux:glibc-langpack-ht, p-cpe:/a:amazon:linux:glibc-langpack-fi, p-cpe:/a:amazon:linux:glibc-langpack-rw, p-cpe:/a:amazon:linux:glibc-langpack-pap, p-cpe:/a:amazon:linux:glibc-langpack-te, p-cpe:/a:amazon:linux:glibc-langpack-li, p-cpe:/a:amazon:linux:glibc-langpack-wo, p-cpe:/a:amazon:linux:glibc-all-langpacks, p-cpe:/a:amazon:linux:glibc-langpack-sk, p-cpe:/a:amazon:linux:glibc-langpack-fy, p-cpe:/a:amazon:linux:glibc-langpack-ga, p-cpe:/a:amazon:linux:glibc-langpack-uk, p-cpe:/a:amazon:linux:libcrypt, p-cpe:/a:amazon:linux:glibc-langpack-xh, p-cpe:/a:amazon:linux:glibc-langpack-fur, p-cpe:/a:amazon:linux:glibc-langpack-ber, p-cpe:/a:amazon:linux:glibc-langpack-tr, p-cpe:/a:amazon:linux:glibc-langpack-af, p-cpe:/a:amazon:linux:glibc-langpack-ff, p-cpe:/a:amazon:linux:glibc-langpack-so, p-cpe:/a:amazon:linux:glibc-langpack-gd, p-cpe:/a:amazon:linux:glibc-langpack-sat, p-cpe:/a:amazon:linux:glibc-langpack-tk, p-cpe:/a:amazon:linux:glibc-langpack-raj, p-cpe:/a:amazon:linux:glibc-langpack-tn, p-cpe:/a:amazon:linux:glibc-langpack-sr, p-cpe:/a:amazon:linux:glibc-langpack-kw, p-cpe:/a:amazon:linux:glibc-langpack-lg, p-cpe:/a:amazon:linux:glibc-langpack-th, p-cpe:/a:amazon:linux:glibc-utils, p-cpe:/a:amazon:linux:glibc-langpack-yo, p-cpe:/a:amazon:linux:glibc-langpack-pl, p-cpe:/a:amazon:linux:nss_db, p-cpe:/a:amazon:linux:glibc-langpack-wa
必需的 KB 项: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
可利用: true
易利用性: Exploits are available
补丁发布日期: 2023/8/21
漏洞发布日期: 2019/11/19