Rapid7 Vulnerability & Exploit Database

CESA-2003:090: glibc security update

Free InsightVM Trial No credit card necessary
Watch Demo See how it all works
Back to Search

CESA-2003:090: glibc security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
03/25/2003
Created
07/25/2018
Added
03/12/2010
Modified
07/04/2017

Description

Updated glibc packages are available to fix an integer overflow in the XDR decoder.

The glibc package contains standard libraries which are used by multiple programs on the system. Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC. NFS, NIS, and many other network services are built upon Sun RPC. The XDR encoder/decoder provided with glibc, derived from Sun's RPC implementation, was demonstrated to be vulnerable to an integer overflow. An integer overflow is present in the xdrmem_getbytes() function of glibc 2.3.1 and earlier. Depending upon the application, this vulnerability could cause buffer overflows and may be exploitable, leading to arbitrary code execution. All users should upgrade to these errata packages which contain patches to the glibc libraries and, therefore, are not vulnerable to these issues. CentOS would like to thank eEye Digital Security for alerting us to this issue.

Solution(s)

  • centos-upgrade-glibc
  • centos-upgrade-glibc-common
  • centos-upgrade-glibc-devel
  • centos-upgrade-glibc-profile
  • centos-upgrade-nscd

References

View more

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;