Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.870670
Category:Red Hat Local Security Checks
Title:RedHat Update for glibc RHSA-2011:0413-01
Summary:The remote host is missing an update for the 'glibc'; package(s) announced via the referenced advisory.
Description:Summary:
The remote host is missing an update for the 'glibc'
package(s) announced via the referenced advisory.

Vulnerability Insight:
The glibc packages contain the standard C libraries used by multiple
programs on the system. These packages contain the standard C and the
standard math libraries. Without these two libraries, a Linux system cannot
function properly.

The fix for CVE-2010-3847 introduced a regression in the way the dynamic
loader expanded the $ORIGIN dynamic string token specified in the RPATH and
RUNPATH entries in the ELF library header. A local attacker could use this
flaw to escalate their privileges via a setuid or setgid program using
such a library. (CVE-2011-0536)

It was discovered that the glibc fnmatch() function did not properly
restrict the use of alloca(). If the function was called on sufficiently
large inputs, it could cause an application using fnmatch() to crash or,
possibly, execute arbitrary code with the privileges of the application.
(CVE-2011-1071)

It was discovered that the locale command did not produce properly escaped
output as required by the POSIX specification. If an attacker were able to
set the locale environment variables in the environment of a script that
performed shell evaluation on the output of the locale command, and that
script were run with different privileges than the attacker's, it could
execute arbitrary code with the privileges of the script. (CVE-2011-1095)

All users should upgrade to these updated packages, which contain
backported patches to correct these issues.

Affected Software/OS:
glibc on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)

Solution:
Please Install the Updated Packages.

CVSS Score:
6.9

CVSS Vector:
AV:L/AC:M/Au:N/C:C/I:C/A:C

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2011-0536
Bugtraq: 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console (Google Search)
http://www.securityfocus.com/archive/1/520102/100/0/threaded
Debian Security Information: DSA-2122-2 (Google Search)
http://lists.debian.org/debian-security-announce/2011/msg00005.html
http://www.mandriva.com/security/advisories?name=MDVSA-2011:178
http://openwall.com/lists/oss-security/2011/02/01/3
http://openwall.com/lists/oss-security/2011/02/03/2
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13086
http://www.redhat.com/support/errata/RHSA-2011-0412.html
http://www.redhat.com/support/errata/RHSA-2011-0413.html
http://securitytracker.com/id?1025289
http://secunia.com/advisories/43830
http://secunia.com/advisories/43989
http://secunia.com/advisories/46397
http://www.ubuntu.com/usn/USN-1009-2
http://www.vupen.com/english/advisories/2011/0863
Common Vulnerability Exposure (CVE) ID: CVE-2011-1071
BugTraq ID: 46563
http://www.securityfocus.com/bid/46563
http://seclists.org/fulldisclosure/2011/Feb/635
http://seclists.org/fulldisclosure/2011/Feb/644
http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html
http://openwall.com/lists/oss-security/2011/02/28/11
http://openwall.com/lists/oss-security/2011/02/28/15
http://openwall.com/lists/oss-security/2011/02/26/3
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12853
http://securitytracker.com/id?1025290
http://secunia.com/advisories/43492
http://securityreason.com/securityalert/8175
Common Vulnerability Exposure (CVE) ID: CVE-2011-1095
http://security.gentoo.org/glsa/glsa-201011-01.xml
http://openwall.com/lists/oss-security/2011/03/08/21
http://openwall.com/lists/oss-security/2011/03/08/22
http://openwall.com/lists/oss-security/2011/03/08/8
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12272
http://securitytracker.com/id?1025286
http://secunia.com/advisories/43976
Common Vulnerability Exposure (CVE) ID: CVE-2010-3847
BugTraq ID: 44154
http://www.securityfocus.com/bid/44154
Bugtraq: 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap (Google Search)
http://www.securityfocus.com/archive/1/515545/100/0/threaded
CERT/CC vulnerability note: VU#537223
http://www.kb.cert.org/vuls/id/537223
Debian Security Information: DSA-2122 (Google Search)
http://www.debian.org/security/2010/dsa-2122
https://www.exploit-db.com/exploits/44024/
https://www.exploit-db.com/exploits/44025/
http://seclists.org/fulldisclosure/2010/Oct/257
http://seclists.org/fulldisclosure/2010/Oct/292
http://seclists.org/fulldisclosure/2010/Oct/294
http://www.mandriva.com/security/advisories?name=MDVSA-2010:207
http://sourceware.org/ml/libc-hacker/2010-10/msg00007.html
RedHat Security Advisories: RHSA-2010:0787
https://rhn.redhat.com/errata/RHSA-2010-0787.html
http://www.redhat.com/support/errata/RHSA-2010-0872.html
http://secunia.com/advisories/42787
SuSE Security Announcement: SUSE-SA:2010:052 (Google Search)
https://lists.opensuse.org/opensuse-security-announce/2010-10/msg00007.html
http://www.ubuntu.com/usn/USN-1009-1
http://www.vupen.com/english/advisories/2011/0025
CopyrightCopyright (c) 2012 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.