CVE-2002-0684

CVE-2002-0684 describes a buffer overflow in the DNS resolver logic used by BIND 4.9.8 and ported to glibc 2.2.5 and earlier. The flaw occurs in resolver/DNS name resolution (getnetbyname/getnetbyaddr) and can allow a remote attacker sending crafted DNS responses to execute arbitrary code. Severa...

CVE-2000-1207

userhelper in the usermode package on Red Hat Linux executes non-setuid programs as root, which does not activate the security measures in glibc and allows the programs to be exploited via format string vulnerabilities in glibc via the LANG or LCALL environment variables CVE-2000-0844...

CVE-2000-1207

CVE-2000-1207 affects the userhelper component in the Red Hat Linux usermode package. It executes non-setuid programs as root, which prevents glibc security measures from activating. This creates a local exposure where vulnerable programs can be exploited via format string weaknesses in glibc, tr...

CVE-2002-0684

Buffer overflow in DNS resolver functions that perform lookup of network names and addresses, as used in BIND 4.9.8 and ported to glibc 2.2.5 and earlier, allows remote malicious DNS servers to execute arbitrary code through a subroutine used by functions such as getnetbyname and getnetbyaddr...

Important: Red Hat Security Advisory: : Updated glibc packages fix vulnerabilities in resolver

Updated glibc packages are available to fix two vulnerabilities in the resolver functions. The glibc package contains standard libraries which are used by multiple programs on the system. A buffer overflow vulnerability has been found in the way the glibc resolver handles the resolution of networ...

DEBIAN-CVE-2002-0651

Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers...

CVE-2002-0651

Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers...

CVE-2002-0651

Buffer overflow in the DNS resolver code used in libc, glibc, and libbind, as derived from ISC BIND, allows remote malicious DNS servers to cause a denial of service and possibly execute arbitrary code via the stub resolvers...

Multiple vendors' Domain Name System (DNS) stub resolvers vulnerable to buffer overflows

Overview Buffer overflow vulnerabilities exists in the DNS stub resolver library used by BSD, ISC BIND, and GNU glibc. Other systems that use DNS resolver code derived from ISC BIND may also be affected. An attacker who is able to control DNS responses could exploit arbitrary code or cause a deni...

CVE-2001-0886

Buffer overflow in glob function of glibc allows attackers to cause a denial of service crash and possibly execute arbitrary code via a glob pattern that ends in a brace "" character...

CVE-2001-0886

Mode C: The CVE-2001-0886 issue is a buffer overflow in the glibc glob(3) implementation. The vulnerability affects glibc’s globbing code and can lead to a crash (DoS) and potentially arbitrary code execution when processing a glob pattern that ends with the brace character “{”. The OpenVAS/DEBIA...

Bypassing libsafe format string protection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Name: libsafe Version: up to 2.0-11 URL: http://www.research.avayalabs.com/project/libsafe/ Author: Wojciech Purczyсski [email protected] Date: March 14, 2002 Issue: ====== Libsafe provides ineffective protection against format string exploit attacks that...

[SECURITY] [DSA-103-1] glibc buffer overflow

Package : glibc Problem type : buffer overflow Debian-specific: no A buffer overflow has been found in the globbing code for glibc. This code which is used to glob patterns for filenames and is commonly used in applications like shells and FTP servers. This has been fixed in versino 2.1.3-20 and ...

glibc glob overflow patched

A buffer overflow has been found in the glob3 function in glibc. Fixed packages for Slackware 8.0 are now available. Here's the information from the Slackware 8.0 ChangeLog: Fri Jan 11 14:07:07 PST 2002 patches/packages/glibc.tgz, patches/packages/glibcso.tgz: Fixed a buffer overflow in the glob3...

CVE-2001-0886

Buffer overflow in glob function of glibc allows attackers to cause a denial of service crash and possibly execute arbitrary code via a glob pattern that ends in a brace "" character...

Переполнение буфера в glob() из glibc

Некорректно обрабатываются строки содержащие символ ''...

[Global InterSec 2001121001] glibc globbing issues.

Global InterSec LLC http://www.globalintersec.com GIS Advisory ID: 2001121001 Changed: 12/12/2001 Author: [email protected] Reference: http://www.globalintersec.com/adv/glibc-glob-2001121001.txt Note: The release of this advisory has been earlier than first planned due to RedHats...

Debian glibc 2 symlink issue could allow arbitrary file overwriting

Overview Some versions of ld.so, the loader for shared libraries in UNIX/LINUX, do not properly clear risky environment variables, allowing a symlink attack to overwrite arbitrary files. Description LDDEBUGOUTPUT specifies a directory in which ld.so creates a file with a predictable name based on...

glibc unsetenv fails to properly handle environment variables passed more than once to a program

Overview The glibc implementation of unsetenv fails to properly remove one of two successive occurrences of the same environment variable if the variable is redundently passed to a program. Description The glibc implementation of unsetenv, if called to remove an environment variable that occurs t...

glibc does not check SUID bit on libraries in /etc/ld.so.cache

Overview The GNU libc library fails to perform a check for the SETUID bit for cached libraries in the /etc/ld.so.cache file. As a result, malicious users may create or modify privileged files. Description The GNU libc library allows preloading libraries via the LDPRELOAD environment variable,...