Lucene search

DebianDEBIAN:DSA-2122-1:511C4

HistoryOct 22, 2010 - 5:05 p.m.

[SECURITY] [DSA 2122-1] New glibc packages fix local privilege escalation

2010-10-2217:05:33

lists.debian.org

Debian Security Advisory DSA-2122-1 [email protected]
http://www.debian.org/security/ Florian Weimer
October 22, 2010 http://www.debian.org/security/faq

Package : glibc
Vulnerability : missing input sanitization
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2010-3847 CVE-2010-3856
Debian Bug : 600667

Ben Hawkes and Tavis Ormandy discovered that the dynamic loader in GNU
libc allows local users to gain root privileges using a crafted
LD_AUDIT environment variable.

For the stable distribution (lenny), this problem has been fixed in
version 2.7-18lenny6.

For the upcoming stable distribution (squeeze), this problem has been
fixed in version 2.11.2-6+squeeze1 of the eglibc package.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your glibc packages.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny

Source archives:

http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7.orig.tar.gz
Size/MD5 checksum: 15386750 8816fbab13a072c0ccef6640c9d20833
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny6.dsc
Size/MD5 checksum: 2864 0a5bae105aada2473191dd8706b4ee3f
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny6.diff.gz
Size/MD5 checksum: 767588 3421a1ff8874348dae35cdf58f447036

Architecture independent packages:

http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.7-18lenny6_all.deb
Size/MD5 checksum: 1629030 8f65d80bdb65e1fcefe13a0f67bb350e
http://security.debian.org/pool/updates/main/g/glibc/locales_2.7-18lenny6_all.deb
Size/MD5 checksum: 4432002 d805e02d461e67f5df3c4dfd87d5ed60
http://security.debian.org/pool/updates/main/g/glibc/glibc-source_2.7-18lenny6_all.deb
Size/MD5 checksum: 16008612 5e40f562173996225e7e6145d60aeeba

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian5armlibc6-dbg< 2.7-18lenny6libc6-dbg_2.7-18lenny6_arm.deb
Debian5alphanscd< 2.7-18lenny6nscd_2.7-18lenny6_alpha.deb
Debian5sparclibnss-dns-udeb< 2.7-18lenny6libnss-dns-udeb_2.7-18lenny6_sparc.deb
Debian5powerpclibc6-pic< 2.7-18lenny6libc6-pic_2.7-18lenny6_powerpc.deb
Debian5sparclibc6-sparcv9b< 2.7-18lenny6libc6-sparcv9b_2.7-18lenny6_sparc.deb
Debian5alphalibc6.1-udeb< 2.7-18lenny6libc6.1-udeb_2.7-18lenny6_alpha.deb
Debian5mipsellibc6-dev-mips64< 2.7-18lenny6libc6-dev-mips64_2.7-18lenny6_mipsel.deb
Debian5alphalibc6.1< 2.7-18lenny6libc6.1_2.7-18lenny6_alpha.deb
Debian5mipslibc6-prof< 2.7-18lenny6libc6-prof_2.7-18lenny6_mips.deb
Debian5ia64libc6.1-dbg< 2.7-18lenny6libc6.1-dbg_2.7-18lenny6_ia64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	5	arm	libc6-dbg	< 2.7-18lenny6	libc6-dbg_2.7-18lenny6_arm.deb
Debian	5	alpha	nscd	< 2.7-18lenny6	nscd_2.7-18lenny6_alpha.deb
Debian	5	sparc	libnss-dns-udeb	< 2.7-18lenny6	libnss-dns-udeb_2.7-18lenny6_sparc.deb
Debian	5	powerpc	libc6-pic	< 2.7-18lenny6	libc6-pic_2.7-18lenny6_powerpc.deb
Debian	5	sparc	libc6-sparcv9b	< 2.7-18lenny6	libc6-sparcv9b_2.7-18lenny6_sparc.deb
Debian	5	alpha	libc6.1-udeb	< 2.7-18lenny6	libc6.1-udeb_2.7-18lenny6_alpha.deb
Debian	5	mipsel	libc6-dev-mips64	< 2.7-18lenny6	libc6-dev-mips64_2.7-18lenny6_mipsel.deb
Debian	5	alpha	libc6.1	< 2.7-18lenny6	libc6.1_2.7-18lenny6_alpha.deb
Debian	5	mips	libc6-prof	< 2.7-18lenny6	libc6-prof_2.7-18lenny6_mips.deb
Debian	5	ia64	libc6.1-dbg	< 2.7-18lenny6	libc6.1-dbg_2.7-18lenny6_ia64.deb

Rows per page:

1-10 of 1461

JSON

Related for DEBIAN:DSA-2122-1:511C4