The poisoned NUL byte, 2014 edition

Posted by Chris Evans, Exploit Writer Underling to Tavis Ormandy Back in this 1998 post to the Bugtraq mailing list, Olaf Kirch outlined an attack he called “The poisoned NUL byte”. It was an off-by-one error leading to writing a NUL byte outside the bounds of the current stack frame. On i386...

SuSE 11.3 Security Update : glibc (SAT Patch Number 9587)

This glibc update contains one security and two non security fixes : - directory traversal in LC locale handling. CVE-2014-0475. bnc887022 - nscd gets activated upon upgrade. bnc882028 - iconv command inserts a extra control code '0F'. bnc886416 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

glibc use-after-free

posixspawnfileactionsaddopen use-fater-free...

[ MDVSA-2014:152 ] glibc

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:152 http://www.mandriva.com/en/support/security/ Package : glibc Date : August 6, 2014 Affected: Business Server 1.0 Problem Description: Updated glibc packages fix security issues: Stephane Chazelas...

Mandriva Linux Security Advisory : glibc (MDVSA-2014:152)

Updated glibc packages fix security issues : Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with .. components in the LC and LANG variables. Together with typical OpenSSH configurations with suitable AcceptEnv settings in...

MGASA-2014-0314 Updated glibc packages fix security issues

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with ".." components in the LC and LANG variables. Together with typical OpenSSH configurations with suitable AcceptEnv settings in sshdconfig, this could conceivably be used to...

Updated glibc packages fix security issues

Stephane Chazelas discovered that directory traversal issue in locale handling in glibc. glibc accepts relative paths with ".." components in the LC and LANG variables. Together with typical OpenSSH configurations with suitable AcceptEnv settings in sshdconfig, this could conceivably be used to...

MGASA-2014-0306 Updated gcc packages fix security vulnerability and other bugs

Updated gcc packages fix the following security issue: Multiple integer overflow issues were found in libgfortran, the run-time support library for the Fortran compiler. These could possibly be used to crash a Fortran application or cause it to execute arbitrary code. CVE-2014-5044 They also fix...

CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

Directory traversal

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

CVE-2014-0475

CVE-2014-0475 affects glibc (GNU C Library) before 2.20, enabling context-dependent attackers to bypass ForceCommand restrictions via dot-dot in locale environment variables (LC_* or LANG). Connected documents corroborate glibc/eglibc impact and reference related advisories from IBM for FlashSyst...

UBUNTU-CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

CVE-2014-0475

Multiple directory traversal vulnerabilities in GNU C Library aka glibc or libc6 before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. dot dot in a 1 LC, 2 LANG, or other locale environment variable...

SuSE 11.3 Security Update : glibc (SAT Patch Number 9477)

glibc has been updated to fix one security issue that could have resulted in free-after-use situations. More information can be found at http://seclists.org/oss-sec/2014/q2/519 This security issue has been fixed : - posixspawnfileactionsaddopen fails to copy the path argument CVE-2014-4043 Also a...

glibc protection bypass

It may be possible to bypass some restriction because of incorrect .. seqence processing in locale related functions...

[SECURITY] [DSA 2976-1] eglibc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2976-1 [email protected] http://www.debian.org/security/ Florian Weimer July 10, 2014 http://www.debian.org/security/faq -...

GNU glibc < 2.12.2 'fnmatch()' Function Stack Corruption Vulnerability

No description provided by source. / Source: http://www.securityfocus.com/bid/46563/info GNU glibc is prone to a stack-corruption vulnerability. An attacker can exploit this issue to execute arbitrary machine code in the context of the application that uses the affected library. Failed exploit...

Solaris 2.6/7.0 /locale Subsystem Format String

No description provided by source. / source: http://www.securityfocus.com/bid/1634/info nectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...

glibc-2.2 and openssh-2.3.0p1 exploits glibc => 2.1.9x

No description provided by source. Charles Stevenson [email protected] glibc-2.2 and openssh-2.3.0p1 Debian 2.3 , Redhat 7.0 This exploits is for glibc = 2.1.9x. [email protected] Edit this if you have a problem with path ssh=/usr/bin/ssh traceroute=/usr/sbin/traceroute...

Libc locale exploit (2)

No description provided by source. / source: http://www.securityfocus.com/bid/1634/info ectiva 4.x/5.x,Debian 2.x,IBM AIX 3.x/4.x,Mandrake 7,RedHat 5.x/6.x,IRIX 6.x, Solaris 2.x/7/8,Turbolinux 6.x,Wirex Immunix OS 6.2 Locale Subsystem Format String Many UNIX operating systems provide...