Login
Newsletter
Werbung

Sicherheit: Zwei Probleme in glibc
Aktuelle Meldungen Distributionen
Name: Zwei Probleme in glibc
ID: MDVSA-2014:152
Distribution: Mandriva
Plattformen: Mandriva Business Server 1.0
Datum: Do, 7. August 2014, 09:28
Referenzen: http://advisories.mageia.org/MGASA-2014-0314.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043
Applikationen: GNU C library

Originalnachricht

This is a multi-part message in MIME format...

------------=_1407346233-20155-3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:152
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : glibc
Date : August 6, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated glibc packages fix security issues:

Stephane Chazelas discovered that directory traversal issue in locale
handling in glibc. glibc accepts relative paths with .. components
in the LC_* and LANG variables. Together with typical OpenSSH
configurations (with suitable AcceptEnv settings in sshd_config),
this could conceivably be used to bypass ForceCommand restrictions
(or restricted shells), assuming the attacker has sufficient level
of access to a file system location on the host to create crafted
locale definitions there (CVE-2014-0475).

David Reid, Glyph Lefkowitz, and Alex Gaynor discovered a bug where
posix_spawn_file_actions_addopen fails to copy the path argument
(glibc bz #17048) which can, in conjunction with many common memory
management techniques from an application, lead to a use after free,
or other vulnerabilities (CVE-2014-4043).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4043
http://advisories.mageia.org/MGASA-2014-0314.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
7e4bd56ba434c72f8c9360e54f3ace30
mbs1/x86_64/glibc-2.14.1-12.7.mbs1.x86_64.rpm
c00abe493846257a224bcd217dbda193
mbs1/x86_64/glibc-devel-2.14.1-12.7.mbs1.x86_64.rpm
3dc3199457ef337c453eb48e757b19d7
mbs1/x86_64/glibc-doc-2.14.1-12.7.mbs1.noarch.rpm
642eec51aea574ccb12fe1212fa50eb6
mbs1/x86_64/glibc-doc-pdf-2.14.1-12.7.mbs1.noarch.rpm
25514e42a9b9ebdde40f5fa059dc5a3c
mbs1/x86_64/glibc-i18ndata-2.14.1-12.7.mbs1.x86_64.rpm
3c9cdb0cd83af355302df271ae63f49d
mbs1/x86_64/glibc-profile-2.14.1-12.7.mbs1.x86_64.rpm
ac264ef2f31ca27d97bd62afcce34af9
mbs1/x86_64/glibc-static-devel-2.14.1-12.7.mbs1.x86_64.rpm
58f3bcd904422da59ac688292c2d9cdc
mbs1/x86_64/glibc-utils-2.14.1-12.7.mbs1.x86_64.rpm
f499b1252ed18408eaa11149da20cc22 mbs1/x86_64/nscd-2.14.1-12.7.mbs1.x86_64.rpm

fc23371516f3983f6c190cbbe9fa475a mbs1/SRPMS/glibc-2.14.1-12.7.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFT4jsumqjQ0CJFipgRAlNQAJ0XRiH3s+wH6V0PIAOhRb/OaQltjgCg4la8
kIl2gBBBEbooSlANUSXW9sY=
=me23
-----END PGP SIGNATURE-----


------------=_1407346233-20155-3
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1407346233-20155-3--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung