The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3092 advisory.

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library     (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that     is too small, potentially leading to heap corruption. (CVE-2018-6485)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3534-1 advisory.

    It was discovered that the GNU C library did not properly handle all of the possible return values from     the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in     setuid programs and gain administrative privileges. (CVE-2018-1000001)

    A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local     attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment     variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink     protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

    A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic     loader. A local attacker could potentially exploit this with a specially crafted value in the     LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a     system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

    An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob()     implementation. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

    A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU     C library glob() implementation. An attacker could potentially exploit this to cause a denial of service     or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

    It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN     for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by     providing a specially crafted library in the current working directory in order to gain administrative     privileges. (CVE-2017-16997)

    It was discovered that the GNU C library malloc() implementation could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-     based overflow. An attacker could potentially exploit this to cause a denial of service or execute     arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.02, has glibc packages installed that are affected by multiple vulnerabilities:

  - The idna_to_ascii_4i function in lib/idna.c in libidn before 1.33 allows context-dependent attackers to     cause a denial of service (out-of-bounds read and crash) via 64 bytes of input. (CVE-2016-6261)

  - The stringprep_utf8_nfkc_normalize function in lib/nfkc.c in libidn before 1.33 allows context-dependent     attackers to cause a denial of service (out-of-bounds read and crash) via crafted UTF-8 data.
    (CVE-2016-6263)

  - A memory leak in glibc 2.1.1 (released on May 24, 1999) can be reached and amplified through the     LD_HWCAP_MASK environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000408)

  - A buffer overflow in glibc 2.5 (released on September 29, 2006) and can be triggered through the     LD_LIBRARY_PATH environment variable. Please note that many versions of glibc are not vulnerable to this     issue if patched for CVE-2017-1000366. (CVE-2017-1000409)

  - Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before 2.0.4 allows remote     attackers to cause a denial of service or possibly have unspecified other impact. (CVE-2017-14062)

  - The GNU C Library (aka glibc or libc6) before 2.27 contains an off-by-one error leading to a heap-based     buffer overflow in the glob function in glob.c, related to the processing of home directories using the ~     operator followed by a long string. (CVE-2017-15670)

  - The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer     overflow during unescaping of user names with the ~ operator. (CVE-2017-15804)

  - elf/dl-load.c in the GNU C Library (aka glibc or libc6) 2.19 through 2.26 mishandles RPATH and RUNPATH     containing $ORIGIN for a privileged (setuid or AT_SECURE) program, which allows local users to gain     privileges via a Trojan horse library in the current working directory, related to the fillin_rpath and     decompose_rpath functions. This is associated with misinterpretion of an empty RPATH/RUNPATH token as the     ./ directory. NOTE: this configuration of RPATH/RUNPATH for a privileged program is apparently very     uncommon; most likely, no such program is shipped with any common Linux distribution. (CVE-2017-16997)

  - The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too     small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to     a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code     path that lacks an integer overflow check. (CVE-2017-17426)

  - An SSE2-optimized memmove implementation for i386 in sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S     in the GNU C Library (aka glibc or libc6) 2.21 through 2.27 does not correctly perform the overlapping     memory check if the source memory range spans the middle of the address space, resulting in corrupt data     being produced by the copy operation. This may disclose information to context-dependent attackers, or     result in a denial of service, or, possibly, code execution. (CVE-2017-18269)

  - In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to     write before the destination buffer leading to a buffer underflow and potential code execution.
    (CVE-2018-1000001)

  - stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very     long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit     architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.
    (CVE-2018-11236)

  - An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27     and earlier may write data beyond the target buffer, leading to a buffer overflow in
    __mempcpy_avx512_no_vzeroupper. (CVE-2018-11237)

  - In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via     getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the     if_nametoindex() function. (CVE-2018-19591)

  - In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-     based buffer over-read via an attempted case-insensitive regular-expression match. (CVE-2019-9169)

  - The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range     reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when     passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to     sysdeps/ieee754/ldbl-96/e_rem_pio2l.c. (CVE-2020-10029)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

运行版本 CORE 5.04 / MAIN 5.04 的远程 NewStart CGSL 主机安装有受多个漏洞影响的 glibc 程序包：- 在 GNU C 库（亦即 glibc 或 libc6）2.26 和更旧版本的 memalign 函数中，实现 posix_memalign 时发生的整数溢出可造成这些函数返回过小的堆区域的指针，进而可能导致堆损坏。(CVE-2018-6485) - GNU C 库 (亦即 glibc 或 libc6) 2.19 到 2.26 中的 elf/dl-load.c 未针对具权限的 (setuid 或 AT_SECURE) 程序正确处理含有 $ORIGIN 的 RPATH 和 RUNPATH，进而允许本地用户通过当前工作目录中的特洛伊木马库获得权限，这与 fillin_rpath 和 decompose_rpath 函数有关。这与将空 RPATH/RUNPATH 令牌误解译为 ./ 目录有关。请注意：针对具权限程序的此 RPATH/RUNPATH 配置显然非常罕见；很可能是，任何常见的 Linux 发行版本都没有随附此类程序。(CVE-2017-16997) - 符合特定条件时，在 GNU C 库 (亦即 glibc 或 libc6) 的 __mempcpy_avx512_no_vzeroupper 函数中发现缓冲区溢出。攻击者可利用此漏洞造成拒绝服务或可能执行代码。(CVE-2018-11237) - 2.27 或更早版本 GNU C 库（亦称为 glibc 或 libc6）中的 stdlib/canonicalize.c，在处理 realpath 函数的过长路径名参数时，可能在 32 位架构上遭遇整数溢出，导致基于堆栈的缓冲区溢出并可能导致执行任意代码。(CVE-2018-11236) 请注意，Nessus 并未针对此问题进行测试，而仅依赖应用程序自我报告的版本号。

远程 Oracle Linux 7 主机上安装的多个程序包受到 ELSA-2018-3092 公告中提及的多个漏洞影响。

  - GNU C 库（又称为 glibc 或 libc6）2.19 - 2.26 中的 elf/dl-load.c 未正确处理具有权限的（setuid 或 AT_SECURE）程序含有 $ORIGIN 的 RPATH 和 RUNPATH，本地用户可利用此漏洞，通过当前工作目录中的特洛伊木马库获取权限，这与 fillin_rpath 和 decompose_rpath 函数相关。这与将空 RPATH/RUNPATH 令牌误解译为 ./ 目录有关。注意：针对具权限程序的此 RPATH/RUNPATH 配置显然非常罕见；很可能是，任何常见的 Linux 发行版本都没有随附此类程序。(CVE-2017-16997)

  - 在 GNU C 库（亦即 glibc 或 libc6）2.26 和更早版本的 memalign 函数中，实现 posix_memalign 时发生的整数溢出可造成这些函数返回过小的堆区域的指针，进而可能导致堆损坏。(CVE-2018-6485)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.27 及较早版本的 stdlib/canonicalize.c 中，处理 realpath 函数过长的路径名参数时，可能会在 32 位架构上遭遇整数溢出，导致基于堆栈的缓冲区溢出，并可能执行任意代码。
    (CVE-2018-11236)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.27 及较早版本中，mempcpy 函数的 AVX-512 优化实现可能在目标缓冲区之外写入数据，
    __mempcpy_avx512_no_vzeroupper。(CVE-2018-11237)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

发现 GNU C 库未能正确处理内核 getcwd(2) syscall 的所有可能返回值。本地攻击者可利用此问题在 setuid 程序执行任意代码并获取管理权限。
(CVE-2018-1000001)

发现 GNU C 库动态加载程序的 _dl_init_paths() 函数中存在内存泄露问题。本地攻击者可能利用此漏洞与 LD_HWCAP_MASK 环境变量中的特制值，结合 CVE-2017-1000409 以及系统上禁用硬链接保护的另一漏洞，以获取管理权限。(CVE-2017-1000408)

发现 GNU C 库动态加载程序的 _dl_init_paths() 函数中存在基于堆栈的缓冲区溢出。本地攻击者可能利用此漏洞与 LD_LIBRARY_PATH 环境变量中的特制值，结合 CVE-2017-1000408 以及系统上禁用硬链接保护的另一漏洞，以获取管理权限。
(CVE-2017-1000409)

发现 GNU C 库 glob() 实施中存在大小差一错误，导致基于堆栈的缓冲区溢出。攻击者可能利用此漏洞造成拒绝服务，或通过恶意特制模式执行任意代码。(CVE-2017-15670)

发现 GNU C 库 glob() 实施在含 ~ 运算符的用户名反转义过程中存在基于堆栈的缓冲区溢出。
攻击者可能利用此漏洞造成拒绝服务，或通过恶意特制模式执行任意代码。
(CVE-2017-15804)

发现 GNU C 库动态加载程序未能正确处理包含特权的（setuid 或 AT_SECURE）程序的 $ORIGIN 的 RPATH 和 RUNPATH。本地攻击者可能利用此问题在当前工作目录提供特制库，以获取管理权限。(CVE-2017-16997)

发现 GNU C 库 malloc() 实施如果尝试分配整体大小接近 SIZE_MAX 的对象，会返回过小的内存块，从而导致基于堆栈的溢出。攻击者可利用此问题造成拒绝服务或执行任意代码。此问题仅影响 Ubuntu 17.10。(CVE-2017-17426)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

运行 MAIN 6.02 版本的远程 NewStart CGSL 主机上安装的 glibc 程序包受到多个漏洞的影响：

  - 在低于 1.33 的 libidn 版本中，上下文有关的攻击者可利用 lib/idna.c 的 idna_to_ascii_4i 函数，通过 64 字节输入，造成拒绝服务（越界读取和崩溃）。(CVE-2016-6261)

  - 在低于 1.33 的 libidn 版本中，上下文有关的攻击者可利用 lib/nfkc.c 的 stringprep_utf8_nfkc_normalize 函数，通过构建的 UTF-8 数据，造成拒绝服务（越界读取和崩溃）。
    (CVE-2016-6263)

  - glibc 2.1.1（1999 年 5 月 24 日发布）中存在内存泄漏，通过 LD_HWCAP_MASK 环境变量可利用此漏洞，并放大影响。请注意，如果已对 CVE-2017-1000366 进行修补，许多 glibc 版本都不易受到此问题的影响。(CVE-2017-1000408)

  - glibc 2.5（2006 年 9 月 29 日发布）中存在缓冲区溢出，通过 LD_LIBRARY_PATH 环境变量可触发此漏洞。请注意，如果已对 CVE-2017-1000366 进行修补，许多 glibc 版本都不易受到此问题的影响。(CVE-2017-1000409)

  - 在低于 2.0.4 的 Libidn2 版本中，puny_decode.c 的 decode_digit 函数存在整数溢出，远程攻击者可利用此漏洞，造成拒绝服务或可能造成其他不明影响。(CVE-2017-14062)

  - 版本低于 2.27 的 GNU C 库（又称为 glibc 或 libc6）包含差一错误，导致 glob.c 的 glob 函数存在基于堆的缓冲区溢出漏洞，这与使用 ~ 运算符后跟长字符串的主目录处理相关。(CVE-2017-15670)

  - 在低于 2.27 的 GNU C 库（又称为 glibc 或 libc6）中，glob.c 的 glob 函数在含运算符 ~ 的用户名非转义过程中存在缓冲区溢出漏洞。(CVE-2017-15804)

  - GNU C 库（又称为 glibc 或 libc6）2.19 - 2.26 中的 elf/dl-load.c 未正确处理具有权限的（setuid 或 AT_SECURE）程序含有 $ORIGIN 的 RPATH 和 RUNPATH，本地用户可利用此漏洞，通过当前工作目录中的特洛伊木马库获取权限，这与 fillin_rpath 和 decompose_rpath 函数相关。这与将空 RPATH/RUNPATH 令牌误解译为 ./ 目录有关。注意：针对具权限程序的此 RPATH/RUNPATH 配置显然非常罕见；很可能是，任何常见的 Linux 发行版本都没有随附此类程序。(CVE-2017-16997)

  - 如果尝试分配大小接近 SIZE_MAX 的对象，GNU C 库（又称为 glibc 或 libc6）2.26 中的 malloc 函数会返回过小的内存块，可能导致后续的堆溢出。存在此问题的原因是，每线程缓存（又称为 tcache）功能启用缺少整数溢出检查的代码路径。(CVE-2017-17426)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.21 - 2.27 的 sysdeps/i386/i686/multiarch/memcpy-sse2-unaligned.S 中，如果源内存范围跨越地址空间中间部分，针对 i386 的 SSE2 优化 memmove 实现无法正确执行重叠内存检查，从而导致复制操作生成损坏数据。此漏洞可能导致向上下文有关的攻击者泄露信息、拒绝服务或可能导致执行代码。(CVE-2017-18269)

  - 在 glibc 2.26 及较早版本中，同时使用 getcwd() 和 realpath() 会产生混淆，攻击者可利用此漏洞，在目的地缓冲区之前写入数据，从而导致缓冲区下溢，并可能执行代码。
    (CVE-2018-1000001)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.27 及较早版本的 stdlib/canonicalize.c 中，处理 realpath 函数过长的路径名参数时，可能会在 32 位架构上遭遇整数溢出，导致基于堆栈的缓冲区溢出，并可能执行任意代码。
    (CVE-2018-11236)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.27 及较早版本中，mempcpy 函数的 AVX-512 优化实现可能在目标缓冲区之外写入数据，
    从而导致 __mempcpy_avx512_no_vzeroupper 发生缓冲区溢出。(CVE-2018-11237)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.28 及之前版本中，尝试通过 getaddrinfo() 解析构建的主机名会导致分配未结束的套接字描述符。这与 if_nametoindex() 函数相关。(CVE-2018-19591)

  - 在 GNU C 库（又称为 glibc 或 libc6）2.29 及之前版本中，posix/regexec.c 的 proceed_next_node 通过尝试匹配不区分大小写的正则表达式，造成基于堆的缓冲区过度读取。(CVE-2019-9169)

  - 如果 80 位长双重函数的输入包含非规范位模式，如在将 0x5d414141414141410000 值传递至 x86 目标上的 sinl 时所见，2.32 之前的 GNU C 库（亦称 glibc 或 libc6）会在范围检查期间导致堆栈上的缓冲区溢出。这与 sysdeps/ieee754/ldbl-96/e_rem_pio2l.c 相关。(CVE-2020-10029)

请注意，Nessus 尚未测试此问题，而是只依赖于应用程序自我报告的版本号。

ID	名稱	產品	系列	已發布	已更新	嚴重性
180807	Oracle Linux 7 : glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2023/9/7	critical
106134	Ubuntu 14.04 LTS / 16.04 LTS : GNU C Library vulnerabilities (USN-3534-1)	Nessus	Ubuntu Local Security Checks	2018/1/18	2024/8/27	critical
147282	NewStart CGSL MAIN 6.02 : glibc Multiple Vulnerabilities (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/5/10	critical
127214	NewStart CGSL CORE 5.04 / MAIN 5.04：glibc 多个漏洞 (NS-SA-2019-0040)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2022/5/19	critical
180807	Oracle Linux 7：glibc (ELSA-2018-3092)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2023/9/7	critical
106134	Ubuntu 14.04 LTS / 16.04 LTS：GNU C 库漏洞 (USN-3534-1)	Nessus	Ubuntu Local Security Checks	2018/1/18	2024/8/27	critical
147282	NewStart CGSL MAIN 6.02：glibc 多个漏洞 (NS-SA-2021-0053)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/5/10	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical