Debianin tietoturvatiedote

DSA-282-1 glibc -- kokonaisluvun ylivuoto

Ilmoitettu:

9. 4.2003

Vaikutuksen alaiset paketit:

Altis:

Kyllä

Viittaukset tietoturvatietokantoihin:

Bugtraq-tietokannassa (SecurityFocuksella): BugTraq-tunniste 7123.
Mitren CVE-sanakirjassa: CVE-2003-0028.
CERT:n alttiudet, tiedotteet ja ongelmahuomiot: VU#516825, CA-2003-10.

Lisätietoa:

eEye Digital Security havaitsi myös GNU libc:n xdrmem_getbytes()-toiminnossa kokonaisluvun ylivuodon. Tämä toiminto on osa Sun'in RPC-totetuksesta peräisin olevaa XDR (external data representation) encoder/decoder-toimintoa. Sovelluksesta riippuen, tämä haavoittuvuus saattaa aiheuttaa puskurin ylivuotoja ja sitä voidaan mahdollisesti käyttää hyväksi mielivaltaista koodia suoritettaessa.

Ongelma on korjattu vakaan jakelun (woody) versiossa 2.2.5-11.5 .

Ongelma on korjattu aiemman vakaan jakelun (potato) versiossa 2.1.3-25 .

Ongelma on korjattu epävakaan jakelun (sid) versiossa 2.3.1-16 .

Suosittelemme päivittämään libc6-paketit.

Korjattu:

Debian GNU/Linux 2.2 (potato)

Lähde:: http://security.debian.org/pool/updates/main/g/glibc/glibc_2.1.3-24.dsc; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.1.3-24.diff.gz; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.1.3.orig.tar.gz
Arkkitehtuuririippumaton komponentti:: http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.1.3-25_all.deb; http://security.debian.org/pool/updates/main/g/glibc/i18ndata_2.1.3-25_all.deb
Alpha:: http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss1-compat_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss1-compat_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss1-compat_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.1.3-25_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.1.3-25_sparc.deb

Debian GNU/Linux 3.0 (woody)

Lähde:: http://security.debian.org/pool/updates/main/g/glibc/glibc_2.2.5-11.5.dsc; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.2.5-11.5.diff.gz; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.2.5.orig.tar.gz
Arkkitehtuuririippumaton komponentti:: http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.2.5-11.5_all.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.2.5-11.5_all.deb
Alpha:: http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.2.5-11.5_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.2.5-11.5_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.2.5-11.5_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.2.5-11.5_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.2.5-11.5_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.2.5-11.5_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.2.5-11.5_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.2.5-11.5_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.2.5-11.5_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.2.5-11.5_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_ia64.deb
HPPA:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_m68k.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/g/glibc/libc6_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-sparc64_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-sparc64_2.2.5-11.5_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.2.5-11.5_sparc.deb

Listattujen tiedostojen MD5-tarkistussummat ovat luettavissa alkuperäisestä tiedotteesta.