Univention Bugzilla – Bug 38407
eglibc: Multiple issues (4.0)
Last modified: 2016-02-17 18:53:41 CET
Crafted DNS responses might cause application crashes or result in arbitrary code execution due to buffer overflow in nss_dns code used in gethostbyname_r and related functions (CVE-2015-3408)
Still unfixed because classified as "Minor issue" by Debian: * Insecure pseudotty ownership changes in pt_chown (CVE-2013-2207) * Denial of service in nss_files (CVE-2014-8121) CVE-2011-5320 is still unfixed because "The issue was present since the dawn of times" (or whatever), patch available upstream but might be too intrusive.
* buffer overflow in gethostbyname_r and related functions (CVE-2015-1781)
CVE-2015-3408 above is invalid
Upstream Debian package version 2.13-38+deb7u10 fixes these issues: * Denial of service in nss_files (CVE-2014-8121) * buffer overflow in gethostbyname_r and related functions (CVE-2015-1781) * getaddrinfo, when processing AF_UNSPEC queries (for dual A/AAAA lookups), could mismanage its internal buffers, leading to a stack-based buffer overflow and arbitrary code execution. This vulnerability affects most applications which perform host name resolution using getaddrinfo, including system services (CVE-2015-7547) * If an invalid separated time value is passed to strftime, the strftime function could crash or leak information. No affected applications are known (CVE-2015-8776) * LD_POINTER_GUARD not ignored for SUID programs, enabling an unintended bypass of a security feature (CVE-2015-8777) * The rarely-used hcreate and hcreate_r functions did not check the size argument properly, leading to a crash (denial of service) for certain arguments. No impacted applications are known at this time (CVE-2015-8778) * The catopen function contains several unbound stack allocations (stack overflows), causing it the crash the process (denial of service). No applications where this issue has a security impact are currently known (CVE-2015-8779)
The upstream package has been imported and built without any additional patches. Advisory: eglibc.yaml
reproducible with 2.13-38.25.2015082816 (CVE-2015-7547-client) OK - CVE-2015-7547-client OK with 2.13-38.28.2016021618 OK - ucs-test OK - eglibc.yaml
<http://errata.software-univention.de/ucs/4.0/400.html>