Debian-Sicherheitsankündigung

DSA-039-1 glibc -- Lokale Datei-Überschreibung

Datum des Berichts:

08. Mär 2001

Betroffene Pakete:

glibc

Verwundbar:

Sicherheitsdatenbanken-Referenzen:

In der Bugtraq-Datenbank (bei SecurityFocus): BugTraq ID 2223.
In Mitres CVE-Verzeichnis: CVE-2001-0169.

Weitere Informationen:

Die Version der GNU libc, die mit Debian GNU/Linux 2.2 freigegeben wurde, litt unter zwei Sicherheitsproblemen:

Es war möglich, LD_PRELOAD zu verwenden, um Dateien zu laden, die in /etc/ld.so.cache gelistet waren, sogar für suid Programme. Dies könnte dazu verwendet werden, um Dateien zu erstellen (und zu überschreiben), auf die der Benutzer keinen Zugriff haben sollte.
Durch die Verwendung von LD_PROFILE würden suid Programme Daten in eine Datei in /var/tmp schreiben, was nicht sicher durchgeführt wurde. Dies konnte ebenfalls verwendet werden, um Dateien zu erstellen (und zu überschreiben), auf die der Benutzer keinen Zugriff haben sollte.

Beide Probleme wurden in Version 2.1.3-17 behoben und wir empfehlen Ihnen, Ihre glibc-Pakete unverzüglich zu aktualisieren.

Bitte beachten Sie, dass als Nebeneffekt zu dieser Aktualisierung ldd nicht mehr bei suid Programmen funktioniert, außer Sie sind als root angemeldet.

Behoben in:

Debian 2.2 (potato)

Quellcode:: http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-17.diff.gz; http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-17.dsc; http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3.orig.tar.gz
Architektur-unabhängige Dateien:: http://security.debian.org/dists/stable/updates/main/binary-all/glibc-doc_2.1.3-17_all.deb; http://security.debian.org/dists/stable/updates/main/binary-all/i18ndata_2.1.3-17_all.deb
alpha:: http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-dbg_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-dev_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-pic_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-prof_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/libnss1-compat_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/locales_2.1.3-17_alpha.deb; http://security.debian.org/dists/stable/updates/main/binary-alpha/nscd_2.1.3-17_alpha.deb
arm:: http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-dbg_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-dev_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-pic_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-prof_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/libc6_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/libnss1-compat_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/locales_2.1.3-17_arm.deb; http://security.debian.org/dists/stable/updates/main/binary-arm/nscd_2.1.3-17_arm.deb
i386:: http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-dbg_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-dev_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-pic_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-prof_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/libc6_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/libnss1-compat_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/locales_2.1.3-17_i386.deb; http://security.debian.org/dists/stable/updates/main/binary-i386/nscd_2.1.3-17_i386.deb
m68k:: http://security.debian.org/dists/stable/updates/main/binary-m68k/libc6-dbg_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/libc6-dev_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/libc6-pic_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/libc6-prof_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/libc6_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/libnss1-compat_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/locales_2.1.3-17_m68k.deb; http://security.debian.org/dists/stable/updates/main/binary-m68k/nscd_2.1.3-17_m68k.deb
powerpc:: http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-dbg_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-dev_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-pic_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-prof_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/libnss1-compat_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/locales_2.1.3-17_powerpc.deb; http://security.debian.org/dists/stable/updates/main/binary-powerpc/nscd_2.1.3-17_powerpc.deb
sparc:: http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-dbg_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-dev_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-pic_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-prof_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/libnss1-compat_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/locales_2.1.3-17_sparc.deb; http://security.debian.org/dists/stable/updates/main/binary-sparc/nscd_2.1.3-17_sparc.deb