{"id": "OSVDB:9010", "bulletinFamily": "software", "title": "GNU libc (glibc) SUID Binary Debugging Information Disclosure", "description": "## Vulnerability Description\nglibc contains a flaw that may lead to an unauthorized information disclosure. LD_DEBUG is allowed on setuid binaries which as a result may allow a local attacker to debug a setuid binary and gain sensitive information about the system, resulting in a loss of confidentiality.\n## Solution Description\nUpgrade to version 2.3.4.20040619-r1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nglibc contains a flaw that may lead to an unauthorized information disclosure. LD_DEBUG is allowed on setuid binaries which as a result may allow a local attacker to debug a setuid binary and gain sensitive information about the system, resulting in a loss of confidentiality.\n## References:\nVendor URL: http://www.gnu.org/software/libc/libc.html\n[Vendor Specific Advisory URL](http://support.avaya.com/elmodocs2/security/ASA-2005-155.pdf)\n[Vendor Specific Advisory URL](http://bugs.gentoo.org/show_bug.cgi?id=59526)\nSecurity Tracker: 1010975\n[Secunia Advisory ID:12306](https://secuniaresearch.flexerasoftware.com/advisories/12306/)\n[Secunia Advisory ID:15186](https://secuniaresearch.flexerasoftware.com/advisories/15186/)\n[Secunia Advisory ID:15415](https://secuniaresearch.flexerasoftware.com/advisories/15415/)\nOther Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200408-16.xml\nOther Advisory URL: http://rhn.redhat.com/errata/RHSA-2005-261.html\nOther Advisory URL: http://rhn.redhat.com/errata/RHSA-2005-256.html\nISS X-Force ID: 17006\n[CVE-2004-1453](https://vulners.com/cve/CVE-2004-1453)\nBugtraq ID: 10963\n", "published": "2004-08-16T05:24:28", "modified": "2004-08-16T05:24:28", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://vulners.com/osvdb/OSVDB:9010", "reporter": "Silvio Cesare(silvio@qualys.com)", "references": [], "cvelist": ["CVE-2004-1453"], "type": "osvdb", "lastseen": "2017-04-28T13:20:04", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "266a56888117e7ce724c3d31c6c5bcc5"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "b220df085e94543a59ded67f2224e0fa"}, {"key": "cvss", "hash": "635d7f080910dc81e99c0ca9b0d4203f"}, {"key": "description", "hash": "d81894cde30899925c84bc13928b350f"}, {"key": "href", "hash": "18f34e61d641be5ec1f3d89ef0103c4b"}, {"key": "modified", "hash": "ff437198489376b666bccd5024b8c29a"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "ff437198489376b666bccd5024b8c29a"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "b686368677f61580c339971e502be3a5"}, {"key": "title", "hash": "aca2a18077c8a26db2311f9ea7756bd0"}, {"key": "type", "hash": "1327ac71f7914948578f08c54f772b10"}], "hash": "a7d12c9d6604529a68124c9736c34ba1895e6efdd09e3efb41db5adff35049aa", "viewCount": 0, "objectVersion": "1.2", "affectedSoftware": [{"name": "glibc", "operator": "eq", "version": "2.1"}, {"name": "glibc", "operator": "eq", "version": "2.1.3 -10"}, {"name": "glibc", "operator": "eq", "version": "2.3.3"}, {"name": "glibc", "operator": "eq", "version": "2.3.2"}, {"name": "glibc", "operator": "eq", "version": "2.0.4"}, {"name": "glibc", "operator": "eq", "version": "2.0.2"}, {"name": "glibc", "operator": "eq", "version": "2.2.1"}, {"name": "glibc", "operator": "eq", "version": "2.0"}, {"name": "glibc", "operator": "eq", "version": "2.0.3"}, {"name": "glibc", "operator": "eq", "version": "2.2.3"}, {"name": "glibc", "operator": "eq", "version": "2.3"}, {"name": "glibc", "operator": "eq", "version": "2.2.4"}, {"name": "glibc", "operator": "eq", "version": "2.0.6"}, {"name": "glibc", "operator": "eq", "version": "2.3.4"}, {"name": "glibc", "operator": "eq", "version": "2.1.3"}, {"name": "glibc", "operator": "eq", "version": "2.0.1"}, {"name": "glibc", "operator": "eq", "version": "2.0.5"}, {"name": "glibc", "operator": "eq", "version": "2.1.9"}, {"name": "glibc", "operator": "eq", "version": "2.3.1"}, {"name": "glibc", "operator": "eq", "version": "2.1.1"}, {"name": "glibc", "operator": "eq", "version": "2.2"}, {"name": "glibc", "operator": "eq", "version": "2.1.1 -6"}, {"name": "glibc", "operator": "eq", "version": "2.2.2"}, {"name": "glibc", "operator": "eq", "version": "2.2.5"}, {"name": "glibc", "operator": "eq", "version": "2.1.2"}], "enchantments": {"vulnersScore": 5.0}}

{"result": {"cve": [{"id": "CVE-2004-1453", "type": "cve", "title": "CVE-2004-1453", "description": "GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LD_DEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.", "published": "2004-12-31T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1453", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-10-11T11:06:01"}], "centos": [{"id": "CESA-2005:256", "type": "centos", "title": "glibc, nptl, nscd security update", "description": "**CentOS Errata and Security Advisory** CESA-2005:256\n\n\nThe GNU libc packages (known as glibc) contain the standard C libraries\nused by applications.\n\nIt was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and\nLD_DYNAMIC_WEAK were not restricted for a setuid program. A local user\ncould utilize this flaw to gain information, such as the list of symbols\nused by the program. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-1453 to this issue.\n\nThis erratum addresses the following bugs in the GNU C Library:\n\n- fix stack alignment in IA-32 clone\n- fix double free in globfree\n- fix fnmatch to avoid jumping based on unitialized memory read\n- fix fseekpos after ungetc\n- fix TZ env var handling if the variable ends with + or -\n- avoid depending on values read from unitialized memory in strtold\n on certain architectures\n- fix mapping alignment computation in dl-load\n- fix i486+ strncat inline assembly\n- make gethostid/sethostid work on bi-arch platforms\n- fix ppc64 getcontext/swapcontext\n- fix pthread_exit if called after pthread_create, but before the created\n thread actually started\n- fix return values for tgamma (+-0)\n- fix handling of very long lines in /etc/hosts\n- avoid page aliasing of thread stacks on AMD64\n- avoid busy loop in malloc if concurrent with fork\n- allow putenv and setenv in shared library constructors\n- fix restoring of CCR in swapcontext and getcontext on ppc64\n- avoid using sigaction (SIGPIPE, ...) in syslog implementation\n\nAll users of glibc should upgrade to these updated packages, which resolve\nthese issues.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011675.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011681.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011720.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011721.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011729.html\nhttp://lists.centos.org/pipermail/centos-announce/2005-May/011730.html\n\n**Affected packages:**\nglibc\nglibc-common\nglibc-debug\nglibc-devel\nglibc-headers\nglibc-profile\nglibc-utils\nnptl-devel\nnscd\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2005-256.html", "published": "2005-05-18T18:01:42", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2005-May/011675.html", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-10-12T14:44:51"}, {"id": "CESA-2005:261-01", "type": "centos", "title": "glibc, nscd security update", "description": "**CentOS Errata and Security Advisory** CESA-2005:261-01\n\n\nThe GNU libc packages (known as glibc) contain the standard C libraries\nused by applications.\n\nFlaws in the catchsegv and glibcbug scripts were discovered. A local user\ncould utilize these flaws to overwrite files via a symlink attack on\ntemporary files. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-0968 and CAN-2004-1382 to\nthese issues.\n\nIt was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not\nrestricted for a setuid program. A local user could utilize this flaw to\ngain information, such as the list of symbols used by the program. The\nCommon Vulnerabilities and Exposures project (cve.mitre.org) has assigned\nthe name CAN-2004-1453 to this issue.\n\nThis erratum also addresses the following bugs in the GNU C Library:\n- Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation\n- Fixed poll on Itanium\n- Now allows setenv/putenv in shared library constructors\n\nUsers of glibc are advised to upgrade to these erratum packages that remove\nthe unecessary glibcbug script and contain backported patches to correct\nthese other issues.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2005-April/011620.html\n\n**Affected packages:**\nglibc\nglibc-common\nglibc-devel\nglibc-profile\nnscd\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/rh21as-errata.html", "published": "2005-04-29T04:46:27", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2005-April/011620.html", "cvelist": ["CVE-2004-1382", "CVE-2004-1453", "CVE-2004-0968"], "lastseen": "2018-01-24T23:01:25"}], "nessus": [{"id": "REDHAT-RHSA-2005-256.NASL", "type": "nessus", "title": "RHEL 3 : glibc (RHSA-2005:256)", "description": "Updated glibc packages that address several bugs are now available.\n\nThis update has been rated as having low security impact by the Red Hat Security Response Team.\n\nThe GNU libc packages (known as glibc) contain the standard C libraries used by applications.\n\nIt was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.\n\nThis erratum addresses the following bugs in the GNU C Library :\n\n - fix stack alignment in IA-32 clone - fix double free in globfree - fix fnmatch to avoid jumping based on uninitialized memory read - fix fseekpos after ungetc - fix TZ env var handling if the variable ends with + or -\n - avoid depending on values read from uninitialized memory in strtold on certain architectures - fix mapping alignment computation in dl-load - fix i486+ strncat inline assembly - make gethostid/sethostid work on bi-arch platforms - fix ppc64 getcontext/swapcontext - fix pthread_exit if called after pthread_create, but before the created thread actually started - fix return values for tgamma (+-0) - fix handling of very long lines in /etc/hosts - avoid page aliasing of thread stacks on AMD64 - avoid busy loop in malloc if concurrent with fork - allow putenv and setenv in shared library constructors - fix restoring of CCR in swapcontext and getcontext on ppc64 - avoid using sigaction (SIGPIPE, ...) in syslog implementation\n\nAll users of glibc should upgrade to these updated packages, which resolve these issues.", "published": "2005-05-19T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=18312", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-10-29T13:45:54"}, {"id": "CENTOS_RHSA-2005-256.NASL", "type": "nessus", "title": "CentOS 3 : glibc (CESA-2005:256)", "description": "Updated glibc packages that address several bugs are now available.\n\nThis update has been rated as having low security impact by the Red Hat Security Response Team.\n\nThe GNU libc packages (known as glibc) contain the standard C libraries used by applications.\n\nIt was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and LD_DYNAMIC_WEAK were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.\n\nThis erratum addresses the following bugs in the GNU C Library :\n\n - fix stack alignment in IA-32 clone - fix double free in globfree - fix fnmatch to avoid jumping based on uninitialized memory read - fix fseekpos after ungetc - fix TZ env var handling if the variable ends with + or -\n - avoid depending on values read from uninitialized memory in strtold on certain architectures - fix mapping alignment computation in dl-load - fix i486+ strncat inline assembly - make gethostid/sethostid work on bi-arch platforms - fix ppc64 getcontext/swapcontext - fix pthread_exit if called after pthread_create, but before the created thread actually started - fix return values for tgamma (+-0) - fix handling of very long lines in /etc/hosts - avoid page aliasing of thread stacks on AMD64 - avoid busy loop in malloc if concurrent with fork - allow putenv and setenv in shared library constructors - fix restoring of CCR in swapcontext and getcontext on ppc64 - avoid using sigaction (SIGPIPE, ...) in syslog implementation\n\nAll users of glibc should upgrade to these updated packages, which resolve these issues.", "published": "2006-07-03T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=21800", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-10-29T13:41:13"}, {"id": "GENTOO_GLSA-200408-16.NASL", "type": "nessus", "title": "GLSA-200408-16 : glibc: Information leak with LD_DEBUG", "description": "The remote host is affected by the vulnerability described in GLSA-200408-16 (glibc: Information leak with LD_DEBUG)\n\n Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information.\n Impact :\n\n An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precendence over those symbols to gain information or perform further exploitation.\n Workaround :\n\n There is no known workaround at this time. All users are encouraged to upgrade to the latest available version of glibc.", "published": "2004-08-30T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=14572", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-10-29T13:33:57"}, {"id": "REDHAT-RHSA-2005-261.NASL", "type": "nessus", "title": "RHEL 2.1 : glibc (RHSA-2005:261)", "description": "Updated glibc packages that address several bugs are now available.\n\nThis update has been rated as having low security impact by the Red Hat Security Response Team.\n\nThe GNU libc packages (known as glibc) contain the standard C libraries used by applications.\n\nFlaws in the catchsegv and glibcbug scripts were discovered. A local user could utilize these flaws to overwrite files via a symlink attack on temporary files. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0968 and CVE-2004-1382 to these issues.\n\nIt was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not restricted for a setuid program. A local user could utilize this flaw to gain information, such as the list of symbols used by the program.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1453 to this issue.\n\nThis erratum also addresses the following bugs in the GNU C Library: - Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation - Fixed poll on Itanium - Now allows setenv/putenv in shared library constructors\n\nUsers of glibc are advised to upgrade to these erratum packages that remove the unnecessary glibcbug script and contain backported patches to correct these other issues.", "published": "2005-04-29T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=18160", "cvelist": ["CVE-2004-1382", "CVE-2004-1453", "CVE-2004-0968"], "lastseen": "2017-10-29T13:45:19"}], "openvas": [{"id": "OPENVAS:54646", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200408-16 (glibc)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200408-16.", "published": "2008-09-24T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=54646", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-07-24T12:50:12"}], "gentoo": [{"id": "GLSA-200408-16", "type": "gentoo", "title": "glibc: Information leak with LD_DEBUG", "description": "### Background\n\nThe GNU C library defines various Unix-like \"system calls\" and other basic facilities needed for a standard POSIX-like application to operate. \n\n### Description\n\nSilvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidentional information. \n\n### Impact\n\nAn attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precendence over those symbols to gain information or perform further exploitation. \n\n### Workaround\n\nThere is no known workaround at this time. All users are encouraged to upgrade to the latest available version of glibc. \n\n### Resolution\n\nAll glibc users should upgrade to the latest version: \n \n \n # emerge sync\n \n # emerge -pv your_version\n # emerge your_version", "published": "2004-08-16T00:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://security.gentoo.org/glsa/200408-16", "cvelist": ["CVE-2004-1453"], "lastseen": "2016-09-06T19:46:23"}], "redhat": [{"id": "RHSA-2005:256", "type": "redhat", "title": "(RHSA-2005:256) glibc security update", "description": "The GNU libc packages (known as glibc) contain the standard C libraries\nused by applications.\n\nIt was discovered that the use of LD_DEBUG, LD_SHOW_AUXV, and\nLD_DYNAMIC_WEAK were not restricted for a setuid program. A local user\ncould utilize this flaw to gain information, such as the list of symbols\nused by the program. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-1453 to this issue.\n\nThis erratum addresses the following bugs in the GNU C Library:\n\n- fix stack alignment in IA-32 clone\n- fix double free in globfree\n- fix fnmatch to avoid jumping based on unitialized memory read\n- fix fseekpos after ungetc\n- fix TZ env var handling if the variable ends with + or -\n- avoid depending on values read from unitialized memory in strtold\n on certain architectures\n- fix mapping alignment computation in dl-load\n- fix i486+ strncat inline assembly\n- make gethostid/sethostid work on bi-arch platforms\n- fix ppc64 getcontext/swapcontext\n- fix pthread_exit if called after pthread_create, but before the created\n thread actually started\n- fix return values for tgamma (+-0)\n- fix handling of very long lines in /etc/hosts\n- avoid page aliasing of thread stacks on AMD64\n- avoid busy loop in malloc if concurrent with fork\n- allow putenv and setenv in shared library constructors\n- fix restoring of CCR in swapcontext and getcontext on ppc64\n- avoid using sigaction (SIGPIPE, ...) in syslog implementation\n\nAll users of glibc should upgrade to these updated packages, which resolve\nthese issues.", "published": "2005-05-18T04:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:NONE/A:NONE/"}, "href": "https://access.redhat.com/errata/RHSA-2005:256", "cvelist": ["CVE-2004-1453"], "lastseen": "2017-08-02T22:57:25"}, {"id": "RHSA-2005:261", "type": "redhat", "title": "(RHSA-2005:261) glibc security update", "description": "The GNU libc packages (known as glibc) contain the standard C libraries\nused by applications.\n\nFlaws in the catchsegv and glibcbug scripts were discovered. A local user\ncould utilize these flaws to overwrite files via a symlink attack on\ntemporary files. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-0968 and CAN-2004-1382 to\nthese issues.\n\nIt was discovered that the use of LD_DEBUG and LD_SHOW_AUXV were not\nrestricted for a setuid program. A local user could utilize this flaw to\ngain information, such as the list of symbols used by the program. The\nCommon Vulnerabilities and Exposures project (cve.mitre.org) has assigned\nthe name CAN-2004-1453 to this issue.\n\nThis erratum also addresses the following bugs in the GNU C Library:\n- Now avoids calling sigaction (SIGPIPE, ...) in syslog implementation\n- Fixed poll on Itanium\n- Now allows setenv/putenv in shared library constructors\n\nUsers of glibc are advised to upgrade to these erratum packages that remove\nthe unecessary glibcbug script and contain backported patches to correct\nthese other issues.", "published": "2005-04-28T04:00:00", "cvss": {"score": 2.1, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://access.redhat.com/errata/RHSA-2005:261", "cvelist": ["CVE-2004-0968", "CVE-2004-1382", "CVE-2004-1453"], "lastseen": "2018-03-28T01:01:46"}]}}