SB2018011501 - OpenSUSE Linux update for glibc

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) Memory leak (CVE-ID: CVE-2017-1000408)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366. A remote attacker can perform a denial of service attack.

2) Buffer overflow (CVE-ID: CVE-2017-1000409)

The vulnerability allows a local authenticated user to execute arbitrary code.

A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366.

3) Memory corruption (CVE-ID: CVE-2017-15670)

The vulnerability allows a remote attacker to execute arbitrary code with elevated privileges on the target system.

The weakness exists in the glob function in glob.c due to off-by-one error. A remote attacker can trigger heap-based buffer overflow and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

4) Memory leak (CVE-ID: CVE-2017-15671)

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in the glob function in glob.c due to it skips freeing allocated memory when processing the ~ operator with a long user name when invoked with GLOB_TILDE. A remote attacker can trigger memory corruption and cause the service to crash.

5) Buffer overflow (CVE-ID: CVE-2017-15804)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the glob function in glob.c due to buffer overflow during unescaping of user names with the ~ operator. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

6) Insecure DLL loading (CVE-ID: CVE-2017-16997)

The vulnerability allows a local attacker to compromise vulnerable system.

The weakness exists in elf/dl-load.c due to insecure .dll loading mechanism when opening files. Alocal attacker can place a file along with specially crafted .dll file on a remote SBM or WebDAV share and execute arbitrary code on the target system with elevated privileges.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

7) Privilege escalation (CVE-ID: CVE-2018-1000001)

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists in due to a change in the processing of pathnames in the getcwd() command introduced in Linux kernel. A local attacker can use a specially crafted application, trigger buffer underflow in the __realpath() function in 'stdlib/canonicalize.c' and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Install update from vendor's website.

References

• https://lists.opensuse.org/opensuse-security-announce/2018-01/msg00040.html