Amazon Linux AMI update for glibc

1) Buffer overflow

EUVDB-ID: #VU42352

Risk: Low

CVSSv3.1: 6.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-4588

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function.

Mitigation

Update the affected packages:

i686:
    glibc-common-2.17-55.84.amzn1.i686
    glibc-debuginfo-2.17-55.84.amzn1.i686
    nscd-2.17-55.84.amzn1.i686
    glibc-devel-2.17-55.84.amzn1.i686
    glibc-debuginfo-common-2.17-55.84.amzn1.i686
    glibc-utils-2.17-55.84.amzn1.i686
    glibc-static-2.17-55.84.amzn1.i686
    glibc-2.17-55.84.amzn1.i686
    glibc-headers-2.17-55.84.amzn1.i686

src:
    glibc-2.17-55.84.amzn1.src

x86_64:
    glibc-static-2.17-55.84.amzn1.x86_64
    glibc-headers-2.17-55.84.amzn1.x86_64
    glibc-common-2.17-55.84.amzn1.x86_64
    glibc-utils-2.17-55.84.amzn1.x86_64
    glibc-devel-2.17-55.84.amzn1.x86_64
    glibc-2.17-55.84.amzn1.x86_64
    glibc-debuginfo-2.17-55.84.amzn1.x86_64
    nscd-2.17-55.84.amzn1.x86_64
    glibc-debuginfo-common-2.17-55.84.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

External links

http://alas.aws.amazon.com/ALAS-2014-355.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.