Security Advisory Critical: glibc security update

Advisory: RHSA-2015:0101-1
Type: Security Advisory
Severity: Critical
Issued on: 2015-01-28
Last updated on: 2015-01-28
Affected Products: Red Hat Enterprise Linux ELS (v. 4)
CVEs (cve.mitre.org): CVE-2015-0235

Details

Updated glibc packages that fix one security issue are now available for
Red Hat Enterprise Linux 4 Extended Life Cycle Support.

Red Hat Product Security has rated this update as having Critical security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

The glibc packages provide the standard C libraries (libc), POSIX thread
libraries (libpthread), standard math libraries (libm), and the Name
Server Caching Daemon (nscd) used by multiple programs on the system.
Without these libraries, the Linux system cannot function correctly.

A heap-based buffer overflow was found in glibc's
__nss_hostname_digits_dots() function, which is used by the gethostbyname()
and gethostbyname2() glibc function calls. A remote attacker able to make
an application call either of these functions could use this flaw to
execute arbitrary code with the permissions of the user running the
application. (CVE-2015-0235)

Red Hat would like to thank Qualys for reporting this issue.

All glibc users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Updated packages

Red Hat Enterprise Linux ELS (v. 4)

SRPMS:
glibc-2.3.4-2.57.el4.2.src.rpm     MD5: 297d3c8fdab7dc96953b00ffa24dd177
SHA-256: 07054cb3f0da72cbc5585438397fecdef17e0e400aac6ebdc63698194dba567c
 
IA-32:
glibc-2.3.4-2.57.el4.2.i386.rpm     MD5: bf5cbd74fc4b217b629081d8da41a9e5
SHA-256: d9d19fca30601a3d6309a6c5b8619d032a3d42ac4e0a7375ffcdce6b6e4c2ba7
glibc-2.3.4-2.57.el4.2.i686.rpm     MD5: 6e177117af6d4a759ca7e9f55a8d5520
SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-common-2.3.4-2.57.el4.2.i386.rpm     MD5: 4bf1aa948600e57f21165872fb3949f2
SHA-256: b0ea4cc7799f43ef6b8a3a41ff16519c19836d8acb0fe75306c982a19e545820
glibc-devel-2.3.4-2.57.el4.2.i386.rpm     MD5: 4db3ea73f9de66f2bb2f62d6b1d51420
SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-headers-2.3.4-2.57.el4.2.i386.rpm     MD5: 44d7e92b49568f7700766e57ae9fd91e
SHA-256: 3578922da3750436b0708b16f49a91b9ad29db10a715c2c71d3ec386b91479c4
glibc-profile-2.3.4-2.57.el4.2.i386.rpm     MD5: 7709f8be7a8306422311447778cf5655
SHA-256: 91ef3b9707e605ca7662e7b42714a17e1b60075c00eec318dc939cdb83762245
glibc-utils-2.3.4-2.57.el4.2.i386.rpm     MD5: e20e947ba8b8d5dee1d7cd00dabe0daf
SHA-256: d528dace670e25d58b87bf5fccf22a8b6365d7fa28f9dec26a31c8d86a54c331
nptl-devel-2.3.4-2.57.el4.2.i386.rpm     MD5: 7d026c834f12102c0fabc5d3a117eb5a
SHA-256: ec848d9ee4548ae102ea2753959373c16fa2489b75b328d2bd7d4cc645ff2cfe
nptl-devel-2.3.4-2.57.el4.2.i686.rpm     MD5: c57d37673dd5161c35e8bb6d76488255
SHA-256: 1bc215d4cd7cf8f157fba7699125ff89d515556ed27796a616c032506258b97c
nscd-2.3.4-2.57.el4.2.i386.rpm     MD5: 756830026db5a11f5df4b2a1a9c6dbc7
SHA-256: a225ed8305366e40b8225333b86ab8a0c6a6701e0c2b1bdc8dce64514ce7944a
 
IA-64:
glibc-2.3.4-2.57.el4.2.i686.rpm     MD5: 6e177117af6d4a759ca7e9f55a8d5520
SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.ia64.rpm     MD5: 2dcad92a9d38c31e97f331e00de0a7b9
SHA-256: b7b1c85a48e66f05eb17ebf61bdfdb1c284fd640fd3683f8121fabc797a4421e
glibc-common-2.3.4-2.57.el4.2.ia64.rpm     MD5: 67eda541cf22b7c6aadd4a0118b30978
SHA-256: 88a0e00358fd93bef6267a4594749ad58ae73399590192ce6c487d4e8a4f879e
glibc-devel-2.3.4-2.57.el4.2.ia64.rpm     MD5: 1a845e576e5b0a5113997a5c22ab11ac
SHA-256: d80ad88b4915cc19a5417e1101da0e4bf2d3be79d153f4ef7f096ecff9fcd40a
glibc-headers-2.3.4-2.57.el4.2.ia64.rpm     MD5: 5903b05c03498359655055c7f232033c
SHA-256: a3d463d7c1e5438e3775539795dffbdf4da7c34745f401e822e7558d29e8f14a
glibc-profile-2.3.4-2.57.el4.2.ia64.rpm     MD5: e7a135260d90ec3a117745257e79f492
SHA-256: 7c89797774e5c687a39a1456fe39c9b91cdf90c68ace8daf5af7299ee019c299
glibc-utils-2.3.4-2.57.el4.2.ia64.rpm     MD5: 965f67e1331845c62d1f415382fb00ce
SHA-256: e7bdb60699e868799e443a6bc68d93c0d8c08a1f508336859a2d291cb2b5598d
nptl-devel-2.3.4-2.57.el4.2.ia64.rpm     MD5: 916337b681d87c76184b21168e2b334c
SHA-256: 9e0fce30c934560a3c61f4fa80235a6617bda787f64d942879885e1f4dac505d
nscd-2.3.4-2.57.el4.2.ia64.rpm     MD5: 5ae68cf4e8638109cd78debba9abbfd0
SHA-256: d0e4cf0ced2f4cc4cd245d4a86974935dc9510855f6e97de76daf3611d7d5dcd
 
x86_64:
glibc-2.3.4-2.57.el4.2.i686.rpm     MD5: 6e177117af6d4a759ca7e9f55a8d5520
SHA-256: 710c36189d6bff2481430ea4118de85010d7467dd85f595ff63b079470dd87d0
glibc-2.3.4-2.57.el4.2.x86_64.rpm     MD5: d1833041a61193c93f9ef100ec85a01f
SHA-256: 714f186b1ca5f9376659436e4d9673344b0bedb73fc18dfaf3dbe69a3ab02856
glibc-common-2.3.4-2.57.el4.2.x86_64.rpm     MD5: 94b70e28d2ab13bf6c11c5bc0a392d5a
SHA-256: 306f6b61c0e09377f61963e0ec7102e15ba4deca45c1aa63cc6018e4e1a332f7
glibc-devel-2.3.4-2.57.el4.2.i386.rpm     MD5: 4db3ea73f9de66f2bb2f62d6b1d51420
SHA-256: 6e2e1404c23dc0aefe97f7f8ecec362dc297ad895fcc074db89cd2f6683cfed5
glibc-devel-2.3.4-2.57.el4.2.x86_64.rpm     MD5: f837104cf7d07b731a5153256a8c01cb
SHA-256: 5598615952ca74682e08353a85b2254b8dce86f162657d03d5416553af4c5c72
glibc-headers-2.3.4-2.57.el4.2.x86_64.rpm     MD5: 6548bb61871f849b1ee1052cf268b038
SHA-256: 5f7b60c1699110569d0c41db8a3e47028565ca09899b38e4a30e4ead11c4eb2c
glibc-profile-2.3.4-2.57.el4.2.x86_64.rpm     MD5: 8f103f53823eeea5d5207c565df6b46b
SHA-256: 46f29697a4df76d7ea03891e53cffce4fcf87d0ff459d952c148bf5099381f23
glibc-utils-2.3.4-2.57.el4.2.x86_64.rpm     MD5: e8e1e3f04ad6088a19e892488336a340
SHA-256: cc59d5fdb521cb683ec70fbfd78b58e2b302379229e9fe568b8688d1c5f36063
nptl-devel-2.3.4-2.57.el4.2.x86_64.rpm     MD5: f995d5e892e7bed20ca44066c02796df
SHA-256: 665a371417990943e1a3a2ceb5141bf29166d7b6aee00d3b041502fe6cdfd798
nscd-2.3.4-2.57.el4.2.x86_64.rpm     MD5: 4d57cdd4f397773aa293e849d4556ae0
SHA-256: a7bae3667f85cfff8d3e61415efbdb04b3a98941b1e499139a4130c5475080f3
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1183461 - CVE-2015-0235 glibc: __nss_hostname_digits_dots() heap-based buffer overflow


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/