GNU libc2 Vulnerability

Bugtraq ID:	391
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 16 1997 12:00AM
Updated:	Dec 16 1997 12:00AM
Credit:	First posted to BugTraq by Wilton Wong <[email protected]> on December 13, 1997. Followups posted by Andreas Jaeger <[email protected]> on December 16, 1997 and Cristian Gafton <[email protected]> on December 16, 1997.
Vulnerable:	Redhat Linux 5.0
Not Vulnerable:	Redhat Linux 5.1 - Standard & Poors ComStock 4.2.4

GNU libc2 Vulnerability

There are several buffer overflow vulnerabilities in GNU libc version 2.0.x prior to 2.0.6. RedHat Linux 5.0 shipped with a vulnerable version, making many of it's suid root binaries exploitable. The consequences of this are local root compromise. It is also possible that this may be exploited remotely.

GNU libc2 Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

GNU libc2 Vulnerability

Solution:
RedHat released an updated version of their glibc2.0.5c rpm which fixed the problem. It is advised that either glibc2 be upgraded to the newest version or RedHat Linux itself upgraded.

GNU libc2 Vulnerability

References: