This updates addresses a critical security vulnerability in the DNS resolver related to `AF_UNSPEC` queries with `getaddrinfo` (CVE-2015-7547). It also includes security fixes for CVE-2015-8777 and CVE-2015-1781. It improves `malloc` scalability for applications which start and terminate many threads. The output of `locale -a` is now ASCII-only (previously, it contained ISO-8859-1 characters).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Arjun Shankar of Red Hat discovered that gethostbyname_r and related functions compute the size of an input buffer incorrectly if the passed-in buffer is misaligned. This results in a buffer overflow.

For the oldoldstable distribution (squeeze), this problem has been fixed in version 2.11.3-4+deb6u6.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2985-1 advisory.

    Martin Carpenter discovered that pt_chown in the GNU C Library did not properly check permissions for tty     files. A local attacker could use this to gain administrative privileges or expose sensitive information.
    (CVE-2013-2207, CVE-2016-2856)

    Robin Hack discovered that the Name Service Switch (NSS) implementation in the GNU C Library did not     properly manage its file descriptors. An attacker could use this to cause a denial of service (infinite     loop). (CVE-2014-8121)

    Joseph Myers discovered that the GNU C Library did not properly handle long arguments to functions     returning a representation of Not a Number (NaN). An attacker could use this to cause a denial of service     (stack exhaustion leading to an application crash) or possibly execute arbitrary code. (CVE-2014-9761)

    Arjun Shankar discovered that in certain situations the nss_dns code in the GNU C Library did not properly     account buffer sizes when passed an unaligned buffer. An attacker could use this to cause a denial of     service or possibly execute arbitrary code. (CVE-2015-1781)

    Sumit Bose and Lukas Slebodnik discovered that the Name Service Switch (NSS) implementation in the GNU C     Library did not handle long lines in the files databases correctly. A local attacker could use this to     cause a denial of service (application crash) or possibly execute arbitrary code. (CVE-2015-5277)

    Adam Nielsen discovered that the strftime function in the GNU C Library did not properly handle out-of-     range argument data. An attacker could use this to cause a denial of service (application crash) or     possibly expose sensitive information. (CVE-2015-8776)

    Hector Marco and Ismael Ripoll discovered that the GNU C Library allowed the pointer-guarding protection     mechanism to be disabled by honoring the LD_POINTER_GUARD environment variable across privilege     boundaries. A local attacker could use this to exploit an existing vulnerability more easily.
    (CVE-2015-8777)

    Szabolcs Nagy discovered that the hcreate functions in the GNU C Library did not properly check its size     argument, leading to an integer overflow. An attacker could use to cause a denial of service (application     crash) or possibly execute arbitrary code. (CVE-2015-8778)

    Maksymilian Arciemowicz discovered a stack-based buffer overflow in the catopen function in the GNU C     Library when handling long catalog names. An attacker could use this to cause a denial of service     (application crash) or possibly execute arbitrary code. (CVE-2015-8779)

    Florian Weimer discovered that the getnetbyname implementation in the GNU C Library did not properly     handle long names passed as arguments. An attacker could use to cause a denial of service (stack     exhaustion leading to an application crash). (CVE-2016-3075)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2199 advisory.

    - Backport fixes for various security flaws (#1209107):
      - Prevent heap buffer overflow in swscanf (CVE-2015-1472, CVE-2015-1473,
          - Prevent integer overflow in _IO_wstr_overflow (#1195762).
      - Prevent potential denial of service in internal_fnmatch (#1197730).
      - Prevent buffer overflow in gethostbyname_r and related functions         with misaligned buffer (CVE-2015-1781, #1199525).
    - Fix invalid file descriptor reuse when sending DNS query       (CVE-2013-7423, #1194143).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that, under certain circumstances, glibc's getaddrinfo() function would send DNS queries to random file descriptors. An attacker could potentially use this flaw to send DNS queries to unintended recipients, resulting in information disclosure or data loss due to the application encountering corrupted data.
(CVE-2013-7423)

A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
(CVE-2015-1781)

A heap-based buffer overflow flaw and a stack overflow flaw were found in glibc's swscanf() function. An attacker able to make an application call the swscanf() function could use these flaws to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application. (CVE-2015-1472, CVE-2015-1473)

An integer overflow flaw, leading to a heap-based buffer overflow, was found in glibc's _IO_wstr_overflow() function. An attacker able to make an application call this function could use this flaw to crash that application or, potentially, execute arbitrary code with the permissions of the user running the application.

A flaw was found in the way glibc's fnmatch() function processed certain malformed patterns. An attacker able to make an application call this function could use this flaw to crash that application.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
89473	Fedora 22 : glibc-2.21-11.fc22 (2016-0480defc94)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
83865	Debian DLA-230-1 : eglibc security update	Nessus	Debian Local Security Checks	2015/5/28	2021/1/11	medium
91334	Ubuntu 14.04 LTS : GNU C Library vulnerabilities (USN-2985-1)	Nessus	Ubuntu Local Security Checks	2016/5/26	2024/8/27	critical
87092	Oracle Linux 7 : glibc (ELSA-2015-2199)	Nessus	Oracle Linux Local Security Checks	2015/11/30	2024/11/1	critical
87556	Scientific Linux Security Update : glibc on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	high

检测

插件搜索

high

medium

critical

critical

high