An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.
(CVE-2014-6040)

It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service. (CVE-2014-8121)

This update also fixes the following bugs :

  - Due to problems with buffer extension and reallocation,     the nscd daemon terminated unexpectedly with a     segmentation fault when processing long netgroup     entries. With this update, the handling of long netgroup     entries has been corrected and nscd no longer crashes in     the described scenario.

  - If a file opened in append mode was truncated with the     ftruncate() function, a subsequent ftell() call could     incorrectly modify the file offset. This update ensures     that ftell() modifies the stream state only when it is     in append mode and the buffer for the stream is not     empty.

  - A defect in the C library headers caused builds with     older compilers to generate incorrect code for the     btowc() function in the older compatibility C++ standard     library. Applications calling btowc() in the     compatibility C++ standard library became unresponsive.
    With this update, the C library headers have been     corrected, and the compatibility C++ standard library     shipped with Scientific Linux has been rebuilt.
    Applications that rely on the compatibility C++ standard     library no longer hang when calling btowc().

  - Previously, when using netgroups and the nscd daemon was     set up to cache netgroup information, the sudo utility     denied access to valid users. The bug in nscd has been     fixed, and sudo now works in netgroups as expected.

glibc was updated to fix security issues and bugs :

  - Separate internal state between getXXent and getXXbyYY     NSS calls (CVE-2014-8121, bsc#918187, BZ #18007)

  - Fix read past end of pattern in fnmatch (bsc#920338, BZ     #17062, BZ #18032, BZ #18036)

  - Fix buffer overflow in nss_dns (CVE-2015-1781,     bsc#927080, BZ #18287)

Also this bug got fixed :

  - Simplify handling of nameserver configuration in     resolver (bsc#917539)

Several vulnerabilities have been discovered in eglibc that may lead to a privilege escalation or denial of service.

Glibc pointer guarding weakness

A weakness in the dynamic loader prior has been found. The issue is that the LD_POINTER_GUARD in the environment is not sanitized allowing local attackers easily to bypass the pointer guarding protection on set-user-ID and set-group-ID programs.

Potential application crash due to overread in fnmatch

When processing certain malformed patterns, fnmatch can skip over the NUL byte terminating the pattern. This can potentially result in an application crash if fnmatch hits an unmapped page before encountering a NUL byte.

_IO_wstr_overflow integer overflow

A miscalculation in _IO_wstr_overflow could potentially be exploited to overflow a buffer.

CVE-2014-8121

DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over the database, which triggers the file pointer to be reset.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 2.11.3-4+deb6u7.

We recommend that you update your packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201602-02 (GNU C Library: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the GNU C Library:
      The Google Security Team and Red Hat discovered a stack-based buffer         overflow in the send_dg() and send_vc() functions due to a buffer         mismanagement when getaddrinfo() is called with AF_UNSPEC         (CVE-2015-7547).
      The strftime() function access invalid memory when passed         out-of-range data, resulting in a crash (CVE-2015-8776).
      An integer overflow was found in the __hcreate_r() function         (CVE-2015-8778).
      Multiple unbounded stack allocations were found in the catopen()         function (CVE-2015-8779).
    Please review the CVEs referenced below for additional vulnerabilities       that had already been fixed in previous versions of sys-libs/glibc, for       which we have not issued a GLSA before.
  Impact :

    A remote attacker could exploit any application which performs host name       resolution using getaddrinfo() in order to execute arbitrary code or       crash the application. The other vulnerabilities can possibly be       exploited to cause a Denial of Service or leak information.
  Workaround :

    A number of mitigating factors for CVE-2015-7547 have been identified.
      Please review the upstream advisory and references below.

According to the versions of the glibc packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - stdlib/canonicalize.c in the GNU C Library (aka glibc     or libc6) 2.27 and earlier, when processing very long     pathname arguments to the realpath function, could     encounter an integer overflow on 32-bit architectures,     leading to a stack-based buffer overflow and,     potentially, arbitrary code execution.(CVE-2018-11236)

  - An integer overflow vulnerability was found in     hcreate() and hcreate_r() functions which could result     in an out-of-bounds memory access. This could lead to     application crash or, potentially, arbitrary code     execution.(CVE-2015-8778)

  - A stack-based buffer overflow was found in the way the     libresolv library performed dual A/AAAA DNS queries. A     remote attacker could create a specially crafted DNS     response which could cause libresolv to crash or,     potentially, execute code with the permissions of the     user running the library. Note: this issue is only     exposed when libresolv is called from the nss_dns NSS     service module.(CVE-2015-7547)

  - A flaw was found in the regular expression matching     routines that process multibyte character input. If an     application utilized the glibc regular expression     matching mechanism, an attacker could provide     specially-crafted input that, when processed, would     cause the application to crash.(CVE-2013-0242)

  - A flaw was found in the way memory was being allocated     on the stack for user space binaries. If heap (or     different memory region) and stack memory regions were     adjacent to each other, an attacker could use this flaw     to jump over the stack guard gap, cause controlled     memory corruption on process stack or the adjacent     memory region, and thus increase their privileges on     the system. This is glibc-side mitigation which blocks     processing of LD_LIBRARY_PATH for programs running in     secure-execution mode and reduces the number of     allocations performed by the processing of LD_AUDIT,     LD_PRELOAD, and LD_HWCAP_MASK, making successful     exploitation of this issue more     difficult.(CVE-2017-1000366)

  - The DNS stub resolver in the GNU C Library (aka glibc     or libc6) before version 2.26, when EDNS support is     enabled, will solicit large UDP responses from name     servers, potentially simplifying off-path DNS spoofing     attacks due to IP fragmentation.(CVE-2017-12132)

  - It was found that the files back end of Name Service     Switch (NSS) did not isolate iteration over an entire     database from key-based look-up API calls. An     application performing look-ups on a database while     iterating over it could enter an infinite loop, leading     to a denial of service.(CVE-2014-8121)

  - Stack-based buffer overflow in the getaddrinfo function     in sysdeps/posix/getaddrinfo.c in the GNU C Library     (aka glibc or libc6) allows remote attackers to cause a     denial of service (crash) via vectors involving hostent     conversion. NOTE: this vulnerability exists because of     an incomplete fix for CVE-2013-4458.(CVE-2016-3706)

  - In glibc 2.26 and earlier there is confusion in the     usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer     underflow and potential code     execution.(CVE-2018-1000001)

  - Stack-based buffer overflow in string/strcoll_l.c in     the GNU C Library (aka glibc or libc6) 2.17 and earlier     allows context-dependent attackers to cause a denial of     service (crash) or possibly execute arbitrary code via     a long string that triggers a malloc failure and use of     the alloca function.(CVE-2012-4424)

  - It was found that the dynamic loader did not sanitize     the LD_POINTER_GUARD environment variable. An attacker     could use this flaw to bypass the pointer guarding     protection on set-user-ID or set-group-ID programs to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-8777)

  - The glob function in glob.c in the GNU C Library (aka     glibc or libc6) before 2.27 contains a buffer overflow     during unescaping of user names with the ~     operator.(CVE-2017-15804)

  - res_query in libresolv in glibc before 2.25 allows     remote attackers to cause a denial of service (NULL     pointer dereference and process crash).(CVE-2015-5180)

  - pt_chown in GNU C Library (aka glibc or libc6) before     2.18 does not properly check permissions for tty files,     which allows local users to change the permission on     the files and obtain access to arbitrary     pseudo-terminals by leveraging a FUSE file     system.(CVE-2013-2207)

  - A stack overflow flaw was found in glibc's swscanf()     function. An attacker able to make an application call     the swscanf() function could use this flaw to crash     that application or, potentially, execute arbitrary     code with the permissions of the user running the     application.(CVE-2015-1473)

  - It was found that getaddrinfo() did not limit the     amount of stack memory used during name resolution. An     attacker able to make an application resolve an     attacker-controlled hostname or IP address could     possibly cause the application to exhaust all stack     memory and crash.(CVE-2013-4458)

  - A heap-based buffer overflow was found in glibc's
    __nss_hostname_digits_dots() function, which is used by     the gethostbyname() and gethostbyname2() glibc function     calls. A remote attacker able to make an application     call either of these functions could use this flaw to     execute arbitrary code with the permissions of the user     running the application.(CVE-2015-0235)

  - Multiple integer overflow flaws, leading to heap-based     buffer overflows, were found in glibc's memory     allocator functions (pvalloc, valloc, and memalign). If     an application used such a function, it could cause the     application to crash or, potentially, execute arbitrary     code with the privileges of the user running the     application.(CVE-2013-4332)

  - An integer overflow in the implementation of the     posix_memalign in memalign functions in the GNU C     Library (aka glibc or libc6) 2.26 and earlier could     cause these functions to return a pointer to a heap     area that is too small, potentially leading to heap     corruption.(CVE-2018-6485)

  - A stack based buffer overflow vulnerability was found     in the catopen() function. An excessively long string     passed to the function could cause it to crash or,     potentially, execute arbitrary code.(CVE-2015-8779)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory.

    Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty     files. A local attacker could use this to gain administrative privileges or expose sensitive information.
    (CVE-2013-2207, CVE-2016-2856)

    Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not     properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite     loop). (CVE-2014-8121)

    Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions     returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service     (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

    Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly     account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2015-1781)

    Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C     Library did not handle long lines in the files databases correctly. A local attacker could use this to     cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

    Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-     range argument data. An attacker could use this to cause a denial of service (application crash) or     possibly expose sensitive information. (CVE-2015-8776)

    Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection     mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege     boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
    (CVE-2015-8777)

    Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size     argument, leading to an integer overflow. An attacker could use to cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2015-8778)

    Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C     Library when handling long catalog names. An attacker could use this to cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

    Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly     handle long names passed as arguments. An attacker could use to cause a denial of service (stack     exhaustion leading to an application crash). (CVE-2016-3075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
82044	Amazon Linux AMI : glibc (ALAS-2015-495)	Nessus	Amazon Linux Local Security Checks	2015/3/25	2018/4/18	medium
82250	Scientific Linux Security Update : glibc on SL7.x x86_64 (20150305)	Nessus	Scientific Linux Local Security Checks	2015/3/26	2021/1/14	medium
83867	openSUSE Security Update : glibc / glibc-testsuite / glibc-utils / etc (openSUSE-2015-383)	Nessus	SuSE Local Security Checks	2015/5/28	2021/1/19	medium
86155	Debian DLA-316-1 : eglibc security update	Nessus	Debian Local Security Checks	2015/9/28	2021/1/11	medium
88822	GLSA-201602-02 : GNU C Library: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/2/18	2024/6/18	critical
125004	EulerOS Virtualization 3.0.1.0 : glibc (EulerOS-SA-2019-1551)	Nessus	Huawei Local Security Checks	2019/5/14	2022/5/20	critical
91334	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	2016/5/26	2024/8/27	critical

检测

插件搜索

medium

medium

medium

medium

critical

critical

critical