Updated glibc packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

It was found that the wordexp() function would perform command substitution even when the WRDE_NOCMD flag was specified. An attacker able to provide specially crafted input to an application using the wordexp() function, and not sanitizing the input correctly, could potentially use this flaw to execute arbitrary commands with the credentials of the user running that application. (CVE-2014-7817)

This issue was discovered by Tim Waugh of the Red Hat Developer Experience Team.

This update also fixes the following bug :

* Prior to this update, if a file stream that was opened in append mode and its underlying file descriptor were used at the same time and the file was truncated using the ftruncate() function on the file descriptor, a subsequent ftell() call on the stream incorrectly modified the file offset by seeking to the new end of the file. This update ensures that ftell() modifies the state of the file stream only when it is in append mode and its buffer is not empty. As a result, the described incorrect changes to the file offset no longer occur.
(BZ#1170187)

All glibc users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

- Fix CVE-2014-6040: crash in code page decoding functions     (IBM933, IBM935, IBM937, IBM939, IBM1364)

  - Fix CVE-2014-7817: command execution in wordexp() with     WRDE_NOCMD specified

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library :

  - CVE-2015-0235     Qualys discovered that the gethostbyname and     gethostbyname2 functions were subject to a buffer     overflow if provided with a crafted IP address argument.
    This could be used by an attacker to execute arbitrary     code in processes which called the affected functions.

  The original glibc bug was reported by Peter Klotz.

  - CVE-2014-7817     Tim Waugh of Red Hat discovered that the WRDE_NOCMD     option of the wordexp function did not suppress command     execution in all cases. This allows a context-dependent     attacker to execute shell commands.

  - CVE-2012-6656 CVE-2014-6040     The charset conversion code for certain IBM multi-byte     code pages could perform an out-of-bounds array access,     causing the process to crash. In some scenarios, this     allows a remote attacker to cause a persistent denial of     service.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2432-1 advisory.

    Siddhesh Poyarekar discovered that the GNU C Library incorrectly handled certain multibyte characters when     using the iconv function. An attacker could possibly use this issue to cause applications to crash,     resulting in a denial of service. This issue only affected Ubuntu 10.04 LTS and Ubuntu 12.04 LTS.
    (CVE-2012-6656)

    Adhemerval Zanella Netto discovered that the GNU C Library incorrectly handled certain multibyte     characters when using the iconv function. An attacker could possibly use this issue to cause applications     to crash, resulting in a denial of service. (CVE-2014-6040)

    Tim Waugh discovered that the GNU C Library incorrectly enforced the WRDE_NOCMD flag when handling the     wordexp function. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2014-7817)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80123	CentOS 7 : glibc (CESA-2014:2023)	Nessus	CentOS Local Security Checks	2014/12/22	2021/1/4	medium
81616	Fedora 20 : glibc-2.18-19.fc20 (2015-2845)	Nessus	Fedora Local Security Checks	2015/3/5	2021/1/11	medium
81029	Debian DSA-3142-1 : eglibc - security update	Nessus	Debian Local Security Checks	2015/1/28	2021/1/11	high
79718	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2432-1)	Nessus	Ubuntu Local Security Checks	2014/12/4	2025/9/3	high

检测

插件搜索

medium

medium

high

high