glibc RESOLV_HOST_CONF File Read Access Vulnerability
BID:2181
Info
glibc RESOLV_HOST_CONF File Read Access Vulnerability
| Bugtraq ID: | 2181 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 10 2001 12:00AM |
| Updated: | Jan 10 2001 12:00AM |
| Credit: | This vulnerability was first announced by Matt Zimmerman <[email protected]> on January 8, 2001 via the Vuln-Dev mailing list. |
| Vulnerable: |
Wirex Immunix OS 7.0 -Beta Terra Soft Solutions Yellow Dog Linux 2.0 Redhat nscd-2.1.92-14.i386.rpm Redhat Linux 7.0 i386 Redhat Linux 7.0 alpha Redhat glibc-profile-2.1.92-14.i386.rpm Redhat glibc-devel-2.1.92-14.i386.rpm Redhat glibc-2.1.92-14.i686.rpm Redhat glibc-2.1.92-14.i386.rpm Debian Linux 2.3 |
| Not Vulnerable: |
Slackware Linux 7.1 Slackware Linux 7.0 Debian Linux 2.2 |
Discussion
glibc RESOLV_HOST_CONF File Read Access Vulnerability
glibc is the C Library distributed with most implementations of the Linux Operating System. It is freely available through the Free Software Foundation, and publicly maintained.
A problem in versions of glibc 2.1.9 and greater allow a local user access to restricted files. A typo in the glibc source creates a situation of insufficent validation and clearing of the environment variable RESOLV_HOST_CONF, a controlled environment variable that is normally cleared when suid/sgid programs are executed. Therefore, it is possible for a local user to set this environment variable to a sensitive system file and gain read privileges to the file. This vulnerability makes it possible for a user with malicious intent to read the shadow file, and gain access to encrypted passwords. Successful exploitation of this vulnerability could lead to compromise of system accounts, elevated privileges, and potentially administrative access.
glibc is the C Library distributed with most implementations of the Linux Operating System. It is freely available through the Free Software Foundation, and publicly maintained.
A problem in versions of glibc 2.1.9 and greater allow a local user access to restricted files. A typo in the glibc source creates a situation of insufficent validation and clearing of the environment variable RESOLV_HOST_CONF, a controlled environment variable that is normally cleared when suid/sgid programs are executed. Therefore, it is possible for a local user to set this environment variable to a sensitive system file and gain read privileges to the file. This vulnerability makes it possible for a user with malicious intent to read the shadow file, and gain access to encrypted passwords. Successful exploitation of this vulnerability could lead to compromise of system accounts, elevated privileges, and potentially administrative access.
Exploit / POC
glibc RESOLV_HOST_CONF File Read Access Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
glibc RESOLV_HOST_CONF File Read Access Vulnerability
Solution:
Updates available:
Redhat glibc-devel-2.1.92-14.i386.rpm
Redhat nscd-2.1.92-14.i386.rpm
Redhat glibc-2.1.92-14.i386.rpm
Redhat glibc-profile-2.1.92-14.i386.rpm
Redhat glibc-2.1.92-14.i686.rpm
Redhat Linux 7.0 alpha
Redhat Linux 7.0 i386
Wirex Immunix OS 7.0 -Beta
Solution:
Updates available:
Redhat glibc-devel-2.1.92-14.i386.rpm
-
Red Hat Inc. 7.0 i386 glibc-devel-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-devel-2.2-12.i386.rpm
Redhat nscd-2.1.92-14.i386.rpm
-
Red Hat Inc. 7.0 i386 nscd-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/nscd-2.2-12.i386.rpm
Redhat glibc-2.1.92-14.i386.rpm
-
Red Hat Inc. 7.0 i386 glibc-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-2.2-12.i386.rpm
Redhat glibc-profile-2.1.92-14.i386.rpm
-
Red Hat Inc. 7.0 i386 glibc-profile-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-profile-2.2-12.i386.rpm
Redhat glibc-2.1.92-14.i686.rpm
-
Red Hat Inc. 7.0 i386 glibc-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-2.2-12.i386.rpm
Redhat Linux 7.0 alpha
-
Red Hat Inc. 7.0 alpha glibc-2.2-12.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/glibc-2.2-12.alpha.rpm -
Red Hat Inc. 7.0 alpha glibc-common-2.2-12.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/glibc-common-2.2-12.alpha.rpm -
Red Hat Inc. 7.0 alpha glibc-devel-2.2-12.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/glibc-devel-2.2-12.alpha.rpm -
Red Hat Inc. 7.0 alpha glibc-profile-2.2-12.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/glibc-profile-2.2-12.alpha.rpm -
Red Hat Inc. 7.0 alpha nscd-2.2-12.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/nscd-2.2-12.alpha.rpm -
Red Hat Inc. 7.0 alphaev6 glibc-2.2-12.alphaev6.rpm
ftp://updates.redhat.com/7.0/alphaev6/glibc-2.2-12.alphaev6.rpm
Redhat Linux 7.0 i386
-
Red Hat Inc. 7.0 i386 glibc-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-2.2-12.i386.rpm -
Red Hat Inc. 7.0 i386 glibc-common-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-common-2.2-12.i386.rpm -
Red Hat Inc. 7.0 i386 glibc-devel-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-devel-2.2-12.i386.rpm -
Red Hat Inc. 7.0 i386 glibc-profile-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/glibc-profile-2.2-12.i386.rpm -
Red Hat Inc. 7.0 i386 nscd-2.2-12.i386.rpm
ftp://updates.redhat.com/7.0/i386/nscd-2.2-12.i386.rpm
Wirex Immunix OS 7.0 -Beta
-
Wirex 7.0 i386 glibc-2.2-12_imnx_7.i386.rpm
http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/glibc-2.2-12_im nx_7.i386.rpm -
Wirex 7.0 i386 glibc-common-2.2-12_imnx_7.i386.rpm
http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/glibc-common-2. 2-12_imnx_7.i386.rpm -
Wirex 7.0 i386 glibc-devel-2.2-12_imnx_7.i386.rpm
http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/glibc-devel-2.2 -12_imnx_7.i386.rpm -
Wirex 7.0 i386 glibc-profile-2.2-12_imnx_7.i386.rpm
http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/glibc-profile-2 .2-12_imnx_7.i386.rpm -
Wirex 7.0 i386 nscd-2.2-12_imnx_7.i386.rpm
http://www.immunix.org/ImmunixOS/7.0-beta/updates/RPMS/nscd-2.2-12_imn x_7.i386.rpm