Linux Kernel STRNCPY Information Leak Vulnerability
BID:10331
Info
Linux Kernel STRNCPY Information Leak Vulnerability
| Bugtraq ID: | 10331 |
| Class: | Design Error |
| CVE: |
CVE-2003-0465 |
| Remote: | No |
| Local: | Yes |
| Published: | May 12 2004 12:00AM |
| Updated: | Jul 12 2009 04:07AM |
| Credit: | The individual responsible for the discovery of this issue is currently unknown. |
| Vulnerable: |
Linux kernel 2.5.69 Linux kernel 2.5.68 Linux kernel 2.5.67 Linux kernel 2.5.66 Linux kernel 2.5.65 Linux kernel 2.5.64 Linux kernel 2.5.63 Linux kernel 2.5.62 Linux kernel 2.5.61 Linux kernel 2.5.60 Linux kernel 2.5.59 Linux kernel 2.5.58 Linux kernel 2.5.57 Linux kernel 2.5.56 Linux kernel 2.5.55 Linux kernel 2.5.54 Linux kernel 2.5.53 Linux kernel 2.5.52 Linux kernel 2.5.51 Linux kernel 2.5.50 Linux kernel 2.5.49 Linux kernel 2.5.48 Linux kernel 2.5.47 Linux kernel 2.5.46 Linux kernel 2.5.45 Linux kernel 2.5.44 Linux kernel 2.5.43 Linux kernel 2.5.42 Linux kernel 2.5.41 Linux kernel 2.5.40 Linux kernel 2.5.39 Linux kernel 2.5.38 Linux kernel 2.5.37 Linux kernel 2.5.36 Linux kernel 2.5.35 Linux kernel 2.5.34 Linux kernel 2.5.33 Linux kernel 2.5.32 Linux kernel 2.5.31 Linux kernel 2.5.30 Linux kernel 2.5.29 Linux kernel 2.5.28 Linux kernel 2.5.27 Linux kernel 2.5.26 Linux kernel 2.5.25 Linux kernel 2.5.24 Linux kernel 2.5.23 Linux kernel 2.5.22 Linux kernel 2.5.21 Linux kernel 2.5.20 Linux kernel 2.5.19 Linux kernel 2.5.18 Linux kernel 2.5.17 Linux kernel 2.5.16 Linux kernel 2.5.15 Linux kernel 2.5.14 Linux kernel 2.5.13 Linux kernel 2.5.12 Linux kernel 2.5.11 Linux kernel 2.5.10 Linux kernel 2.5.9 Linux kernel 2.5.8 Linux kernel 2.5.7 Linux kernel 2.5.6 Linux kernel 2.5.5 Linux kernel 2.5.4 Linux kernel 2.5.3 Linux kernel 2.5.2 Linux kernel 2.5.1 Linux kernel 2.5 .0 Linux kernel 2.4.26 Linux kernel 2.4.25 Linux kernel 2.4.24 Linux kernel 2.4.23 Linux kernel 2.4.22 Linux kernel 2.4.21 Linux kernel 2.4.20 Linux kernel 2.4.19 Linux kernel 2.4.18 Linux kernel 2.4.17 Linux kernel 2.4.16 Linux kernel 2.4.15 Linux kernel 2.4.14 Linux kernel 2.4.13 Linux kernel 2.4.12 Linux kernel 2.4.11 Linux kernel 2.4.10 Linux kernel 2.4.9 Linux kernel 2.4.8 Linux kernel 2.4.7 Linux kernel 2.4.6 Linux kernel 2.4.5 Linux kernel 2.4.4 Linux kernel 2.4.3 Linux kernel 2.4.2 Linux kernel 2.4.1 Linux kernel 2.4 |
| Not Vulnerable: |
Linux kernel 2.6.5 Linux kernel 2.6.4 Linux kernel 2.6.3 Linux kernel 2.6.2 Linux kernel 2.6.1 |
Discussion
Linux Kernel STRNCPY Information Leak Vulnerability
This issue is reported to affect the vulnerable kernel only on platforms other than x86.
It has been reported that the Linux kernel is prone to a 'strncpy()' information leak vulnerability. This issue is due to a failure of the libc code to properly implement the offending function on platforms other than x86.
This issue might lead to information leakage, potentially facilitating further attacks against an affected system or process.
This issue is reported to affect the vulnerable kernel only on platforms other than x86.
It has been reported that the Linux kernel is prone to a 'strncpy()' information leak vulnerability. This issue is due to a failure of the libc code to properly implement the offending function on platforms other than x86.
This issue might lead to information leakage, potentially facilitating further attacks against an affected system or process.
Exploit / POC
Linux Kernel STRNCPY Information Leak Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Linux Kernel STRNCPY Information Leak Vulnerability
Solution:
Red Hat has released advisory RHSA-2004:188-14 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
A kernel upgrade is available that deals with this issue. It is advised that all affected systems upgrade to Linux kernel 2.6.X is possible.
Solution:
Red Hat has released advisory RHSA-2004:188-14 dealing with this and other issues for their enterprise linux distribution. Customers subscribed to the Red Hat Network may apply the appropriate fixes using the Red Hat Update Agent (up2date). Please see referenced advisory for additional information.
A kernel upgrade is available that deals with this issue. It is advised that all affected systems upgrade to Linux kernel 2.6.X is possible.
References
Linux Kernel STRNCPY Information Leak Vulnerability
References:
References: