Skip to navigation

Security Advisory Updated glibc packages provide security and bug fixes

Advisory: RHSA-2003:325-10
Type: Security Advisory
Severity: N/A
Issued on: 2003-11-12
Last updated on: 2003-11-13
Affected Products: Red Hat Linux 7.1
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
Red Hat Linux 9
CVEs (cve.mitre.org): CVE-2003-0689
CVE-2003-0859

Details

Updated glibc packages that resolve vulnerabilities and address several bugs
are now available.

The glibc packages contain GNU libc, which provides standard system libraries.

A bug in the getgrouplist function can cause a buffer overflow if
the size of the group list is too small to hold all the user's groups.
This overflow can cause segmentation faults in user applications, which may
have security implications, depending on the application in question. This
vulnerability exists only when an administrator has placed a user in a
number of groups larger than that expected by an application. Therefore,
there is no risk in instances where users are members of few groups. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2003-0689 to this issue.

Herbert Xu reported that various applications can accept spoofed messages
sent on the kernel netlink interface by other users on the local machine.
This could lead to a local denial of service attack. In Red Hat Linux 9
and later, the glibc function getifaddrs uses netlink and could therefore
be vulnerable to this issue. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2003-0859 to this issue.

In addition to the security issues, a number of other bugs were fixed.

Users are advised to upgrade to these erratum packages, which contain a
patch that checks that netlink messages actually came from the kernel, a
backported security patch for the getgroups list vulnerability, and patches
for the various bug fixes.

[Update 2003-11-13]: The packages for Red Hat Linux 9 have been updated
for compatibility with kernels not provided by Red Hat.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run the following
command at a shell prompt:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. On the i686
architecture, *.i686.rpm packages should be installed where available
rather than *.i386.rpm.

If you are unsure which architecture you are on, run the following
command at a shell prompt:

rpm -q --qf '%{arch}\n' glibc

Only those RPMs which are currently installed will be updated. Those RPMs
which are not installed but included in the list will not be updated.
Note that you can also use wildcards (*.rpm) if your current directory
only contains the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an updated
certificate. The latest version of up2date is available from the Red Hat
FTP site and may also be downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Updated packages

Red Hat Linux 7.1

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/SRPMS/glibc-2.2.4-33.src.rpm
Missing file
    MD5: 08a9d7fdb2cc277c80f5a0e1529d7774
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/i386/glibc-2.2.4-33.i386.rpm
Missing file
    MD5: 83d041d5a108d6a27d5bb7e465c62d45
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/i686/glibc-2.2.4-33.i686.rpm
Missing file
    MD5: 5585734c0358b3ba1f952dedbd9c443f
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.2.4-33/i386/glibc-common-2.2.4-33.i386.rpm
Missing file
    MD5: a99df9fce0cf177d42f611ca178a6717
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.2.4-33/i386/glibc-devel-2.2.4-33.i386.rpm
Missing file
    MD5: 9848447715453548af83418087deccd4
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.2.4-33/i386/glibc-profile-2.2.4-33.i386.rpm
Missing file
    MD5: d68a6aec30cf1e7d8fb7fc1c0b95e00d
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.2.4-33/i386/nscd-2.2.4-33.i386.rpm
Missing file
    MD5: bee8aa9dd31b75b099c9fc6c5bd3295f
 
Red Hat Linux 7.2

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/SRPMS/glibc-2.2.4-33.src.rpm
Missing file
    MD5: 08a9d7fdb2cc277c80f5a0e1529d7774
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/i386/glibc-2.2.4-33.i386.rpm
Missing file
    MD5: 83d041d5a108d6a27d5bb7e465c62d45
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/i686/glibc-2.2.4-33.i686.rpm
Missing file
    MD5: 5585734c0358b3ba1f952dedbd9c443f
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.2.4-33/i386/glibc-common-2.2.4-33.i386.rpm
Missing file
    MD5: a99df9fce0cf177d42f611ca178a6717
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.2.4-33/i386/glibc-devel-2.2.4-33.i386.rpm
Missing file
    MD5: 9848447715453548af83418087deccd4
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.2.4-33/i386/glibc-profile-2.2.4-33.i386.rpm
Missing file
    MD5: d68a6aec30cf1e7d8fb7fc1c0b95e00d
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.2.4-33/i386/nscd-2.2.4-33.i386.rpm
Missing file
    MD5: bee8aa9dd31b75b099c9fc6c5bd3295f
 
IA-64:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.4-33/ia64/glibc-2.2.4-33.ia64.rpm
Missing file
    MD5: d0ded4d10fc72bfa3da24de5a7a078a0
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.2.4-33/ia64/glibc-common-2.2.4-33.ia64.rpm
Missing file
    MD5: 44a7683cdfd8f763ccb1405784815fe4
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.2.4-33/ia64/glibc-devel-2.2.4-33.ia64.rpm
Missing file
    MD5: 5bd01df1cfc06fed52b3dd2928cef950
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.2.4-33/ia64/glibc-profile-2.2.4-33.ia64.rpm
Missing file
    MD5: 27738cfcb12b46ee61e02950b39ed44e
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.2.4-33/ia64/nscd-2.2.4-33.ia64.rpm
Missing file
    MD5: a0aad5ab63319615dac47dde5b5d9e16
 
Red Hat Linux 7.3

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.5-44/SRPMS/glibc-2.2.5-44.src.rpm
Missing file
    MD5: 8a161087ca8a0262fd1cdec70a0486a6
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.5-44/i386/glibc-2.2.5-44.i386.rpm
Missing file
    MD5: eb0107c7a3187b0c782314bf3cf38771
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.2.5-44/i686/glibc-2.2.5-44.i686.rpm
Missing file
    MD5: 6c915957618eb229d17f1db2f0684f0f
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.2.5-44/i386/glibc-common-2.2.5-44.i386.rpm
Missing file
    MD5: a22c95134d40d601ba1ee4dd69cb8372
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug/2.2.5-44/i386/glibc-debug-2.2.5-44.i386.rpm
Missing file
    MD5: 46ed43e8ce6108be6dc628dc14093df5
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug/2.2.5-44/i686/glibc-debug-2.2.5-44.i686.rpm
Missing file
    MD5: 82fe179cf917a3b012bdb1b2c50d6e7d
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug-static/2.2.5-44/i386/glibc-debug-static-2.2.5-44.i386.rpm
Missing file
    MD5: 7945db62704b881f661b6972420564c1
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.2.5-44/i386/glibc-devel-2.2.5-44.i386.rpm
Missing file
    MD5: 128c022a95b405e9628711f65e9bdf0b
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.2.5-44/i386/glibc-profile-2.2.5-44.i386.rpm
Missing file
    MD5: 241a34a7487d9ff11bea274a11812f73
ftp://updates.redhat.com/rhn/repository/NULL/glibc-utils/2.2.5-44/i386/glibc-utils-2.2.5-44.i386.rpm
Missing file
    MD5: 1ba6bb800c87ed6eb497862da2e5d428
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.2.5-44/i386/nscd-2.2.5-44.i386.rpm
Missing file
    MD5: 3a465a1bbb95463cc837f1a3e7a20dbd
 
Red Hat Linux 8.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-4.80.8/SRPMS/glibc-2.3.2-4.80.8.src.rpm
Missing file
    MD5: d6c96dff6893d449a57439ec3b362ded
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-4.80.8/i386/glibc-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 8058c50430bca5ee527c3521b8cd5019
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-4.80.8/i686/glibc-2.3.2-4.80.8.i686.rpm
Missing file
    MD5: 44d62332cb2494a62ad95473237b5ad4
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.3.2-4.80.8/i386/glibc-common-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 62019c1ecff44880be70871a9b52c4bc
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug/2.3.2-4.80.8/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 854a98301d8b8000c752a25d70b6634b
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug/2.3.2-4.80.8/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
Missing file
    MD5: 1a74ed2bd5bc54a33f21543a59805235
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug-static/2.3.2-4.80.8/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 44eb3be20de572a08370182cb5ee82d9
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.3.2-4.80.8/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 4b091e271eac8c15ff68112b8b74b597
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.3.2-4.80.8/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 1bf2647c6eadf4ca934f9a8e6ab5c8d4
ftp://updates.redhat.com/rhn/repository/NULL/glibc-utils/2.3.2-4.80.8/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: abfc2b5f8ee84966f136a6d703fb104d
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.3.2-4.80.8/i386/nscd-2.3.2-4.80.8.i386.rpm
Missing file
    MD5: 0c890751f548c460207e2514ca61b3ca
 
Red Hat Linux 9

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-27.9.7/SRPMS/glibc-2.3.2-27.9.7.src.rpm
Missing file
    MD5: b0835a2d24994b0ec50b73f10e91c839
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-27.9.7/i386/glibc-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 8e9e1bd574b10b6a55ee627973a46c7d
ftp://updates.redhat.com/rhn/repository/NULL/glibc/2.3.2-27.9.7/i686/glibc-2.3.2-27.9.7.i686.rpm
Missing file
    MD5: b1311b31b1e2f349aaef5bba91be3caa
ftp://updates.redhat.com/rhn/repository/NULL/glibc-common/2.3.2-27.9.7/i386/glibc-common-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 9a369a25585261ac590e4e02cde90d49
ftp://updates.redhat.com/rhn/repository/NULL/glibc-debug/2.3.2-27.9.7/i386/glibc-debug-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 54c566f6dbf63e8efd8d48fcd845f48d
ftp://updates.redhat.com/rhn/repository/NULL/glibc-devel/2.3.2-27.9.7/i386/glibc-devel-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 83e103623d0b9e05937edc775094ad68
ftp://updates.redhat.com/rhn/repository/NULL/glibc-profile/2.3.2-27.9.7/i386/glibc-profile-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 7e6d0c5f8586a2605ed38d8ceb768973
ftp://updates.redhat.com/rhn/repository/NULL/glibc-utils/2.3.2-27.9.7/i386/glibc-utils-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 14f1b45918fc14abd744776c6cc8c9ce
ftp://updates.redhat.com/rhn/repository/NULL/nptl-devel/2.3.2-27.9.7/i686/nptl-devel-2.3.2-27.9.7.i686.rpm
Missing file
    MD5: 2d7819fa0bd582e4746e9b8ddbbceecf
ftp://updates.redhat.com/rhn/repository/NULL/nscd/2.3.2-27.9.7/i386/nscd-2.3.2-27.9.7.i386.rpm
Missing file
    MD5: 920d4bfedfb843818a38dcdfc491c6ef
 

Bugs fixed (see bugzilla for more information)

101261 - getnameinfo fails to to reverse lookup on IPv6 addresses
101691 - CAN-2003-0689 Buffer overrun in getgrouplist function in initgroups.c
102709 - NPTL pthread_cond_broadcast hangs.
103727 - LD_PROFILE=libc.so.6 and sprof give seg fault
105348 - Closing socket breaks the cancellation type of current thread
107846 - locale utility is broken on big-endian 64-bit platforms
108634 - Signal handler installation races with signal, glibc-2.3.2
109904 - problems after [RHSA-2003:325-01] glibc upgrades
109918 - executable code in .data in ld.so renders system unusable for PaX users
54697 - nscd locks immediately if started with -t 1 and nss_ldap is used
83973 - Wrong sort order for uk_UA locale
85994 - SIGSEGV in malloc: __morecore clobbered by perror conflict with _IO_check_libio
86032 - trailing spaces in /etc/ld.so.conf entries are not ignored
88409 - strxfrm() overruns buffer by indexing with uninitialized value
88456 - glibc-2.3.2-27.9.i686.rpm does not rpm -Fvh properly.
88978 - locale ja_JP.EUC-JP has two undefined bytes [buffer overrun]
89448 - getaddrinfo segv - unitialized structure?
90002 - binary compatibility for '_res' broken in glibc 2.3.x
90036 - race/deadlock in fork() with signal handler.
90077 - fopen@GLIBC_2_0 corrupts memory arena by buffer overrun
90301 - Programs fail at exit if compiled with gcc and cxa_atexit
90987 - sprintf() is limited to 2^26 bytes.
91567 - setegid sets saved gid
97814 - "Incorrectly built binary which accesses errno..." message in elf/rtld.c needs some way to be silenced.
97828 - Sudo returns segmentation fault
98966 - ldconfig automatically prepends /usr/lib and /lib to search order


References


Keywords

getgrouplist, netlink


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/