glibc: integer overflow in the xdrmem_getbytes() function
| Package(s): | glibc krb5 dietlibc | CVE #(s): | CAN-2003-0028 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | March 21, 2003 | Updated: | May 27, 2003 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | An integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, and glibc, allows remote attackers to execute arbitrary code via certain integer values in length fields See CAN-2003-0028 and CERT advisory CA-2003-10 for more information. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Posted Mar 27, 2003 17:10 UTC (Thu)
by k-squire (guest, #5595)
[Link] (1 responses)
Kevin
Posted Mar 27, 2003 17:34 UTC (Thu)
by ris (subscriber, #5)
[Link]
Posted Apr 10, 2003 17:09 UTC (Thu)
by ronaldcole (guest, #1462)
[Link]
<http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=87480>
The Debian alert posted here refers to the krb5 kerberos package, not glibc. AFAIK, Debian has not yet posted a glibc update.Debian alert incorrect
It is true that Debian's alert is for krb5, but it's addressing the same problems in the SUNRPC library.
Debian alert incorrect
See Bugzilla bug #87480 to see if you really want to apply Redhat's fix... I'm surprised that they haven't pushed out an errata for this "fix" yet!Redhat's "fix" breaks other packages...