Executive Summary

Summary
Title Updated glibc packages
Informations
Name RHSA-2004:586 First vendor Publication 2004-12-20
Vendor RedHat Last vendor Modification 2004-12-20
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score 2.1 Attack Range Local
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated glibc packages that address several bugs and implement some enhancements are now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, i686, ia64, ppc, ppc64, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, i686, x86_64 Red Hat Enterprise Linux ES version 3 - i386, i686, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, i686, ia64, x86_64

3. Problem description:

The GNU libc packages (known as glibc) contain the standard C libraries used by applications.

This errata fixes several bugs in the GNU C Library.

Fixes include (in addition to enclosed Bugzilla entries):

- - fixed 32-bit atomic operations on 64-bit powerpc - - fixed -m32 -I /usr/include/nptl compilation on AMD64 - - NPTL should now be usable in C++ code or -pedantic -std=c89 C - - rwlocks are now available also in the _POSIX_C_SOURCE=200112L namespace - - pthread_once is no longer throw(), as the callback routine might throw - - pthread_create now correctly returns EAGAIN when thread couldn't be created because of lack of memory - - fixed NPTL stack freeing in case of pthread_create failure with detached thread - - fixed pthread_mutex_timedlock on i386 and AMD64 - - Itanium gp saving fix in linuxthreads - - fixed s390/s390x unwinding tests done during cancellation if stack frames are small - - fixed fnmatch(3) backslash handling - - fixed out of memory behaviour of syslog(3) - - resolver ID randomization - - fixed fim (NaN, NaN) - - glob(3) fixes for dangling symlinks - - catchsegv fixed to work with both 32-bit and 64-bit binaries on x86-64, s390x and ppc - - fixed reinitialization of _res when using NPTL stack cache - - updated bug reporting instructions, removed glibcbug script - - fixed infinite loop in iconv with some options - - fixed inet_aton return value - - CPU friendlier busy waiting in linuxthreads on EM64T and IA-64 - - avoid blocking/masking debug signal in linuxthreads - - fixed locale program output when neither LC_ALL nor LANG is set - - fixed using of unitialized memory in localedef - - fixed mntent_r escape processing - - optimized mtrace script - - linuxthread_db fixes on ppc64 - - cfi instructions in x86-64 linuxthreads vfork - - some _POSIX_C_SOURCE=200112L namespace fixes

All users of glibc should upgrade to these updated packages, which resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

123583 - getnameinfo does not use /etc/hosts for lookup of V4MAPPED addresses 132816 - glibc in RHEL 3 needs to have syslog.c updated to cvs version 1.42 132204 - glibc-nis-performance.patch causes gdm to hang 118574 - malloc exhausts memory to fast in mulithreaded program 127606 - __builtin_expect's prototype does not expect int args; assert feeds it just that 103415 - Weird string in date printing 136726 - RHEL3 U5: execvp fails if ENODEV encountered during PATH search 135234 - Problem with gethostbyaddr with latest UDP 136318 - CAN-2004-0968 temporary file vulnerabilities in catchsegv script 130254 - glibc's traceback() fails when called from an exception handler 116428 - RHEL3 U4: statfs64 132654 - LTC10984 - 1.3.1 Linux JVM hanging on RedHat EL 3 update 3

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2004-586.html

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:9523
 
Oval ID: oval:org.mitre.oval:def:9523
Title: The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.
Description: The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0968
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 26
Os 3
Os 1

OpenVAS Exploits

Date Description
2008-09-24 Name : Gentoo Security Advisory GLSA 200410-19 (glibc)
File : nvt/glsa_200410_19.nasl
2008-01-17 Name : Debian Security Advisory DSA 636-1 (glibc)
File : nvt/deb_636_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
11040 GNU libc (glibc) catchsegv Script Symlink Arbitrary File Overwrite

Nessus® Vulnerability Scanner

Date Description
2006-01-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-4-1.nasl - Type : ACT_GATHER_INFO
2005-04-29 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2005-261.nasl - Type : ACT_GATHER_INFO
2005-01-13 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-636.nasl - Type : ACT_GATHER_INFO
2005-01-02 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-159.nasl - Type : ACT_GATHER_INFO
2004-12-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-586.nasl - Type : ACT_GATHER_INFO
2004-10-21 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200410-19.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:48:44
  • Multiple Updates