Debian Security Advisory

glibc -- local root exploit

Date Reported:
02 Sep 2000
Affected Packages:
libc6, libc6.1
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2000-0824, CVE-2000-0844.
More information:
Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code.

The first problem is the way ld.so handles environment variables: In order to provide a safe environment for setuid applications it removes certain the environment variables that can influence application execution such as LD_PRELOAD and LD_LIBRARY_PATH. Unfortunately there was a bug that could cause ld.so to not remove them under some conditions. This would affect setuid applications if they execute another binary without dropping privileges or cleaning up the environment themselves.

The second problem is the locale handling in glibc. glibc checks for characters like `/' in the LANG and LC_* environment variables to see if someone is trying to trick a program into reading arbitrary files. Unfortunately there were some logic errors in those checks which could be used to make a setuid application use arbitrary files for localization settings, which can be exploited to trick it into executing arbitrary code.

These problems have been fixed in version 2.0.7.19981211-6.3 for Debian GNU/Linux 2.1 (slink) and 2.1.3-13 for Debian GNU/Linux 2.2 (potato). We recommend that you upgrade your glibc package immediately.

Fixed in:

Debian GNU/Linux 2.1 (slink)

Source:
http://security.debian.org/dists/slink/updates/source/glibc_2.0.7.19981211-6.3.diff.gz
http://security.debian.org/dists/slink/updates/source/glibc_2.0.7.19981211-6.3.dsc
http://security.debian.org/dists/slink/updates/source/glibc_2.0.7.19981211.orig.tar.gz
i386:
http://security.debian.org/dists/slink/updates/binary-i386/libc6-dbg_2.0.7.19981211-6.3_i386.deb
http://security.debian.org/dists/slink/updates/binary-i386/libc6-dev_2.0.7.19981211-6.3_i386.deb
http://security.debian.org/dists/slink/updates/binary-i386/libc6-pic_2.0.7.19981211-6.3_i386.deb
http://security.debian.org/dists/slink/updates/binary-i386/libc6_2.0.7.19981211-6.3_i386.deb
http://security.debian.org/dists/slink/updates/binary-i386/locales_2.0.7.19981211-6.3_i386.deb
http://security.debian.org/dists/slink/updates/binary-i386/timezones_2.0.7.19981211-6.3_i386.deb

Debian GNU/Linux 2.2 (potato)

Source:
http://security.debian.org/dists/potato/updates/main/source/glibc_2.1.3-13.diff.gz
http://security.debian.org/dists/potato/updates/main/source/glibc_2.1.3-13.dsc
http://security.debian.org/dists/potato/updates/main/source/glibc_2.1.3.orig.tar.gz
Architecture-independent component:
http://security.debian.org/dists/potato/updates/main/binary-all/glibc-doc_2.1.3-13_all.deb
http://security.debian.org/dists/potato/updates/main/binary-all/i18ndata_2.1.3-13_all.deb
alpha:
http://security.debian.org/dists/potato/updates/main/binary-alpha/libc6.1-dbg_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/libc6.1-dev_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/libc6.1-pic_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/libc6.1-prof_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/libc6.1_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/libnss1-compat_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/locales_2.1.3-13_alpha.deb
http://security.debian.org/dists/potato/updates/main/binary-alpha/nscd_2.1.3-13_alpha.deb
arm:
http://security.debian.org/dists/potato/updates/main/binary-arm/libc6-dbg_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/libc6-dev_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/libc6-pic_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/libc6-prof_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/libc6_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/locales_2.1.3-13_arm.deb
http://security.debian.org/dists/potato/updates/main/binary-arm/nscd_2.1.3-13_arm.deb
i386:
http://security.debian.org/dists/potato/updates/main/binary-i386/libc6-dbg_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/libc6-dev_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/libc6-pic_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/libc6-prof_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/libc6_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/libnss1-compat_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/locales_2.1.3-13_i386.deb
http://security.debian.org/dists/potato/updates/main/binary-i386/nscd_2.1.3-13_i386.deb
powerpc:
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libc6-dbg_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libc6-dev_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libc6-pic_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libc6-prof_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/libc6_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/locales_2.1.3-13_powerpc.deb
http://security.debian.org/dists/potato/updates/main/binary-powerpc/nscd_2.1.3-13_powerpc.deb
sparc:
http://security.debian.org/dists/potato/updates/main/binary-sparc/libc6-dbg_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/libc6-dev_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/libc6-pic_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/libc6-prof_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/libc6_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/locales_2.1.3-13_sparc.deb
http://security.debian.org/dists/potato/updates/main/binary-sparc/nscd_2.1.3-13_sparc.deb