Updated glibc packages fix vulnerabilities in RPC XDR decoder

Updated glibc packages are available to fix a buffer overflow in the XDR
decoder.

The glibc package contains standard libraries which are used by
multiple programs on the system. Sun RPC is a remote procedure call
framework which allows clients to invoke procedures in a server process
over a network. XDR is a mechanism for encoding data structures for use
with RPC. NFS, NIS, and many other network services are built upon Sun
RPC. glibc contains an XDR encoder/decoder derived from Sun's RPC
implementation which was recently demonstrated to be vulnerable to a heap
overflow.

An error in the calculation of memory needed for unpacking arrays in the
XDR decoder in glibc 2.2.5 and earlier can result in a heap buffer
overflow. Depending upon the application, this vulnerability may be
exploitable and lead to arbitrary code execution.

All users should upgrade to these errata packages which contain patches to
the glibc libraries and therefore are not vulnerable to these issues.

Thanks to Solar Designer for providing patches for this issue

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0391
http://online.securityfocus.com/archive/1/285308

buffer, overflow, RPC, sun, XDR