Debians sikkerhedsbulletin

DSA-2058-1 glibc, eglibc -- flere sårbarheder

Rapporteret den:

10. jun 2010

Berørte pakker:

Sårbar:

Referencer i sikkerhedsdatabaser:

I Debians fejlsporingssystem: Fejl 583908.
I Mitres CVE-ordbog: CVE-2008-1391, CVE-2009-4880, CVE-2009-4881, CVE-2010-0296, CVE-2010-0830.

Yderligere oplysninger:

Flere sårbarheder er opdaget i GNU C Library (alias glibc) og dets aflæggere. Projektet Common Vulnerabilities and Exposures har registreret følgende problemer:

CVE-2008-1391, CVE-2009-4880, CVE-2009-4881
Maksymilian Arciemowicz opdagede at GNU C-biblioteket ikke på korrekt vis håndterede heltalsoverløb i strfmon-funktionsfamilien. Hvis en bruger eller automatiseret system blev narret til at behandle en særligt fremstillet formatstring, kunne en fjernangriber få applikationer til at gå ned, medførende et lammelsesangreb (denial of service).
CVE-2010-0296
Jeff Layton og Dan Rosenberg opdagede at GNU C-biblioteket ikke på korrekt vis håndterede newlines i mntent-funktionsfamilien. Hvis en lokal angriber havde mulighed for at sprøjte newlines ind i et mount-entry gennem andre sårbare mount-hjælpere, kunne vedkommende afbryde systemet eller muligvis få rootrettigheder.
CVE-2010-0830
Dan Rosenberg opdagede at GNU C-biblioteket ikke på korrekt vis validerede visse ELF-programheadere. Hvis en bruger eller automatiseret system blev narret til at verificere et særligt fremstillet ELF-program, kunne en fjernangriber udføre vilkårlig kode med brugerrettigheder.

I den stabile distribution (lenny), er disse problemer rettet i version 2.7-18lenny4 af glibc-pakken.

I distributionen testing (squeeze), vil disse problemer snart blive rettet.

I den ustabile distribution (sid), er disse problemer blevet rettet i version 2.1.11-1 af eglibc-pakken.

Vi anbefaler at du opgraderer dine glibc or eglibc-pakker.

Rettet i:

Debian GNU/Linux 5.0 (lenny)

Kildekode:: http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny4.diff.gz; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7.orig.tar.gz; http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny4.dsc
Arkitekturuafhængig komponent:: http://security.debian.org/pool/updates/main/g/glibc/glibc-source_2.7-18lenny4_all.deb; http://security.debian.org/pool/updates/main/g/glibc/locales_2.7-18lenny4_all.deb; http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.7-18lenny4_all.deb
Alpha:: http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_alpha.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_alpha.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-alphaev67_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_alpha.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-udeb_2.7-18lenny4_alpha.udeb
AMD64:: http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-i386_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-i386_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_amd64.udeb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_amd64.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_amd64.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_amd64.udeb
ARM:: http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_arm.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_arm.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_arm.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_arm.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_arm.deb
ARM EABI:: http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_armel.udeb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_armel.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_armel.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_armel.udeb
HP Precision:: http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_hppa.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_hppa.udeb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_hppa.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_hppa.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_hppa.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_i386.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_i386.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-i686_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-xen_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-amd64_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-amd64_2.7-18lenny4_i386.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_i386.udeb
Intel IA-64:: http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-udeb_2.7-18lenny4_ia64.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_ia64.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_ia64.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_ia64.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.7-18lenny4_ia64.deb
Big-endian MIPS:: http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_mips.udeb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_mips.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-mips64_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-mipsn32_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-mips64_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-mipsn32_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_mips.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_mips.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_mips.deb
Little-endian MIPS:: http://security.debian.org/pool/updates/main/g/glibc/libc6-mips64_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_mipsel.udeb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_mipsel.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-mips64_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-mipsn32_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_mipsel.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-mipsn32_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_mipsel.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/g/glibc/libc6-ppc64_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_powerpc.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_powerpc.udeb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-ppc64_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_powerpc.udeb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_powerpc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-s390x_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_s390.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_s390.udeb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_s390.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-s390x_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_s390.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/g/glibc/libc6-sparc64_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny4_sparc.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.7-18lenny4_sparc.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-sparc64_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny4_sparc.udeb; http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny4_sparc.deb; http://security.debian.org/pool/updates/main/g/glibc/libc6-sparcv9b_2.7-18lenny4_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.