[Subject Prev][Subject Next][Thread Prev][Thread Next][Subject Index][Thread Index]
(fwd) [SECURITY] New version of glibc released
[Yup, Debian is vulnerable too, as, presumably, other distributions
also. Please upgrade -- Raju]
This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------
Approved-By: aleph1@xxxxxxxxxxxxxxxxx
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxxxxxxxx
Received: from securityfocus.com (mail.securityfocus.com [207.126.127.78]) by
lists.securityfocus.com (Postfix) with SMTP id 849291EF82 for
<bugtraq@xxxxxxxxxxxxxxxxxxxxxxx>; Sat, 2 Sep 2000 09:19:53 -0700
(PDT)
Received: (qmail 3247 invoked by alias); 2 Sep 2000 16:21:11 -0000
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxx
Received: (qmail 3244 invoked from network); 2 Sep 2000 16:21:10 -0000
Received: from murphy.debian.org (216.234.231.6) by mail.securityfocus.com with
SMTP; 2 Sep 2000 16:21:10 -0000
Received: (qmail 23663 invoked by uid 38); 2 Sep 2000 16:17:53 -0000
X-Envelope-Sender: wichert@xxxxxxx
Received: (qmail 23621 invoked from network); 2 Sep 2000 16:17:51 -0000
Received: from soil08.soil.nl (HELO cloud.wiggy.net) (root@xxxxxxxxxxxxxx) by
murphy.debian.org with SMTP; 2 Sep 2000 16:17:51 -0000
Received: (from wichert@localhost) by cloud.wiggy.net (8.9.3/8.9.3/Debian
8.9.3-21) id SAA08818 for debian-security-announce@xxxxxxxxxxxxxxxx;
Sat, 2 Sep 2000 18:17:50 +0200
X-Debian: PGP check passed for security officers
Priority: urgent
X-Mailing-List: <debian-security-announce@xxxxxxxxxxxxxxxx> archive/latest/117
X-Loop: debian-security-announce@xxxxxxxxxxxxxxxx
Precedence: list
Message-ID: <22xCZ.A.mxF.xgSs5@murphy>
Reply-To: security@xxxxxxxxxx
Comments: Resent-From: debian-security-announce@xxxxxxxxxxxxxxxx
Comments: Originally-From: Wichert Akkerman <wichert@xxxxxxx>
From: debian-security-announce@xxxxxxxxxxxxxxxx
Sender: Bugtraq List <BUGTRAQ@xxxxxxxxxxxxxxxxx>
To: BUGTRAQ@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] New version of glibc released
Date: Sat, 2 Sep 2000 09:19:53 -0700
-----BEGIN PGP SIGNED MESSAGE-----
- ------------------------------------------------------------------------
Debian Security Advisory security@xxxxxxxxxx
http://www.debian.org/security/ Wichert Akkerman
September 2, 2000
- ------------------------------------------------------------------------
Package: glibc
Vulnerability: local exploit
Debian-specific: no
Recently two problems have been found in the glibc suite, which could be
used to trick setuid applications to run arbitrary code.
The first problem is the way ld.so handles environment variables: in
order to provide a safe environment for setuid applications it removes
certain the environment variables that can influence application
execution such as LD_PRELOAD and LD_LIBRARY_PATH. Unfortunately there
was a bug that could cause ld.so to not remove them under some
conditions. This would affect setuid applications if they execute
another binary without dropping privileges or cleaning up the
environment themselves.
The second problem is the locale handling in glibc. glibc checks for
characters like `/' in the LANG and LC_* environment variables to see if
someone is trying to trick a program into reading arbitrary files.
Unfortunately there were some logic errors in those checks which could
be used to make a setuid application use arbitrary files for localization
settings, which can be exploited to trick it into executing arbitrary
code.
These problems have been fixed in version 2.1.3-13, and we recommend
that you upgrade your glibc package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 2.1 alias slink
- ------------------------------------
No update is available for slink; we will release an advisory with
more information about this release later.
Debian GNU/Linux 2.2 alias potato
- ------------------------------------
Potato was released for the alpha, arm, i386, m68k, powerpc and sparc
architectures. At this moment packages for m68k are not yet
available. As soon as they are ready we will put them online and
list them on the security pages at http://security.debian.org/.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-13.diff.gz
MD5 checksum: 70fcaf79c3c1e84c6bb18c579784b062
http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3-13.dsc
MD5 checksum: fd82c79e94f4adfacad7ac7e10a82850
http://security.debian.org/dists/stable/updates/main/source/glibc_2.1.3.orig.tar.gz
MD5 checksum: aea1bb5c28f793013153d1b8f91eb746
Architecture indendent archives:
http://security.debian.org/dists/stable/updates/main/binary-all/glibc-doc_2.1.3-13_all.deb
MD5 checksum: 715d058a21da37459873fa9810f8ac80
http://security.debian.org/dists/stable/updates/main/binary-all/i18ndata_2.1.3-13_all.deb
MD5 checksum: 6c90c6b465428d76ed7292258f11b5b6
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-dbg_2.1.3-13_alpha.deb
MD5 checksum: 9b3766a8c636e0475eb1123227d6efd5
http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-dev_2.1.3-13_alpha.deb
MD5 checksum: cee532947e5169b21309ac8a2175e28c
http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-pic_2.1.3-13_alpha.deb
MD5 checksum: 34bdaa22187f7fb28bde26980f288663
http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1-prof_2.1.3-13_alpha.deb
MD5 checksum: 9caab3a0d2965defc917a3f7d639cb67
http://security.debian.org/dists/stable/updates/main/binary-alpha/libc6.1_2.1.3-13_alpha.deb
MD5 checksum: bd80fa7df7b35298b03fa86ed4eddb58
http://security.debian.org/dists/stable/updates/main/binary-alpha/libnss1-compat_2.1.3-13_alpha.deb
MD5 checksum: ffa9525ee030d7d1314db3b052e5df1f
http://security.debian.org/dists/stable/updates/main/binary-alpha/locales_2.1.3-13_alpha.deb
MD5 checksum: a2b2b33cf960cf826edc3aa5387e7d27
http://security.debian.org/dists/stable/updates/main/binary-alpha/nscd_2.1.3-13_alpha.deb
MD5 checksum: ed04bda8579a4ec939e8ee09942f7b1f
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-dbg_2.1.3-13_arm.deb
MD5 checksum: da2b951b1ffe58526e5c9a032ef5f73c
http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-dev_2.1.3-13_arm.deb
MD5 checksum: 771857d6aab61fc88da0c8e740421690
http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-pic_2.1.3-13_arm.deb
MD5 checksum: 63d85ff2300b43fd1dc5617b09bbd213
http://security.debian.org/dists/stable/updates/main/binary-arm/libc6-prof_2.1.3-13_arm.deb
MD5 checksum: 8584f4af0aa50edf32a447efd0a31c65
http://security.debian.org/dists/stable/updates/main/binary-arm/libc6_2.1.3-13_arm.deb
MD5 checksum: 15364347a059937f66c73fcf08d1dd46
http://security.debian.org/dists/stable/updates/main/binary-arm/locales_2.1.3-13_arm.deb
MD5 checksum: 4d0d0f3138e6f7634079deebc010a239
http://security.debian.org/dists/stable/updates/main/binary-arm/nscd_2.1.3-13_arm.deb
MD5 checksum: da07801bb41e66e753999b1b2d932084
Intel ia32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-dbg_2.1.3-13_i386.deb
MD5 checksum: 5f807f96733f5e20f5b96c41db83b213
http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-dev_2.1.3-13_i386.deb
MD5 checksum: 706320b902f75df49648807260cfbedc
http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-pic_2.1.3-13_i386.deb
MD5 checksum: 640caa2b950660108554aa775222c753
http://security.debian.org/dists/stable/updates/main/binary-i386/libc6-prof_2.1.3-13_i386.deb
MD5 checksum: d63917ecf3baffefef63f3192d92c0d3
http://security.debian.org/dists/stable/updates/main/binary-i386/libc6_2.1.3-13_i386.deb
MD5 checksum: 4fa5f5586c96ac8e77519324326268af
http://security.debian.org/dists/stable/updates/main/binary-i386/libnss1-compat_2.1.3-13_i386.deb
MD5 checksum: 5a0ba8bfdd1909f1b999b672761c23ad
http://security.debian.org/dists/stable/updates/main/binary-i386/locales_2.1.3-13_i386.deb
MD5 checksum: ba677879a912e15d72abac4026c0385f
http://security.debian.org/dists/stable/updates/main/binary-i386/nscd_2.1.3-13_i386.deb
MD5 checksum: ae98fbe3e00aa8be3700622e7d84ff2b
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-dbg_2.1.3-13_powerpc.deb
MD5 checksum: 555aad39f66aacd796a770a0a03016be
http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-dev_2.1.3-13_powerpc.deb
MD5 checksum: 4fbd5aefb34c2081dc1e7f0e02ff5ae7
http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-pic_2.1.3-13_powerpc.deb
MD5 checksum: 7056a4bade2e2826a440c5308217b6f2
http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6-prof_2.1.3-13_powerpc.deb
MD5 checksum: ec364dba9a60cd0a030549a1b9a17389
http://security.debian.org/dists/stable/updates/main/binary-powerpc/libc6_2.1.3-13_powerpc.deb
MD5 checksum: cfc05198b7db0184543170d98c43d415
http://security.debian.org/dists/stable/updates/main/binary-powerpc/locales_2.1.3-13_powerpc.deb
MD5 checksum: 572422ea41d70bec2e4fb2c979f539b8
http://security.debian.org/dists/stable/updates/main/binary-powerpc/nscd_2.1.3-13_powerpc.deb
MD5 checksum: e4875824d6e56fb71bec517368643e07
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-dbg_2.1.3-13_sparc.deb
MD5 checksum: a6ce8fc46495d37666fc3ffa41c928ec
http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-dev_2.1.3-13_sparc.deb
MD5 checksum: 0450318920b99f6f9f2f11b7c1c6ffe2
http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-pic_2.1.3-13_sparc.deb
MD5 checksum: 8c47c80ded91aba75127da261821a92a
http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6-prof_2.1.3-13_sparc.deb
MD5 checksum: f48e298dbf9bda280dd3deb0f32b1796
http://security.debian.org/dists/stable/updates/main/binary-sparc/libc6_2.1.3-13_sparc.deb
MD5 checksum: 27df020bfceab1c066477cc9150d22c2
http://security.debian.org/dists/stable/updates/main/binary-sparc/locales_2.1.3-13_sparc.deb
MD5 checksum: 9358612ba28d43d1a101715eeafce758
http://security.debian.org/dists/stable/updates/main/binary-sparc/nscd_2.1.3-13_sparc.deb
MD5 checksum: f86593fd83626b59d0675323dbdc698f
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
- --
- ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
dpkg-ftp:ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv
iQB1AwUBObEoLKjZR/ntlUftAQHf0gL+PFcffgnczWkFzcl6eXP8I3I7GBMdLUrq
0EfUi9c6Y0VGbGNIocDuh87Md8aYHBXusNIymrvI25qdwizrcZwdooTQka7SelRe
8A6uT+f2WgxTrMKnmVUyrYiYcyDlKRkJ
=fAUV
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-security-announce-request@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx
------------------------------
End of this Digest
******************