Potential remote root exploit in glibc [LWN.net]

Package(s):

glibc

CVE #(s):

CAN-2002-0391

Created:

August 14, 2002

Updated:

June 29, 2003

Description:

Felix von Leitner, discovered a potential division by zero bug in code derived from the SunRPC library which is used in glibc.This bug could be exploited to gain unauthorized root access to software linking to glibc.

Updating as soon as practical is a good idea.

Because SunRPC-derived XDR libraries are used by a variety of vendors in a variety of applications, this defect may lead to a number of differing security problems. Exploiting this vulnerability will lead to denial of service, execution of arbitrary code, or the disclosure of sensitive information.

CERT/CC Vulnerability Note VU#192995 Integer overflow in xdr_array() function when deserializing the XDR stream

Alerts:

Debian	DSA-333-1	2003-06-27
Conectiva	CLA-2002:535	2002-10-29
Trustix	2002-0070	2002-10-17
EnGarde	ESA-20021003-021	2002-10-03
Gentoo	glibc-20020927	2002-09-27
Gentoo	dietlibc-20020927	2002-09-27
Debian	DSA-149-2	2002-09-26
Mandrake	MDKSA-2002:061	2002-09-23
Gentoo	glibc-20020905	2002-09-05
SuSE	SuSE-SA:2002:031	2002-08-30
Trustix	2002-0067	2002-08-13
Eridani	ERISA-2002:036	2002-08-13
Red Hat	RHSA-2002:166-07	2002-08-12
Debian	DSA-149-1	2002-08-13

(Log in to post comments)