Test ID:	1.3.6.1.4.1.25623.1.0.881722
Category:	CentOS Local Security Checks
Title:	CentOS Update for glibc CESA-2013:0769 centos5
Summary:	The remote host is missing an update for the 'glibc'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the referenced advisory. Vulnerability Insight: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. (CVE-2013-1914) A flaw was found in the regular expression matching routines that process multibyte character input. If an application utilized the glibc regular expression matching mechanism, an attacker could provide specially-crafted input that, when processed, would cause the application to crash. (CVE-2013-0242) This update also fixes the following bugs: * The improvements RHSA-2012:1207 made to the accuracy of floating point functions in the math library caused performance regressions for those functions. The performance regressions were analyzed and a fix was applied that retains the current accuracy but reduces the performance penalty to acceptable levels. Refer to Red Hat Knowledge solution 229993, linked to in the References, for further information. (BZ#950535) * It was possible that a memory location freed by the localization code could be accessed immediately after, resulting in a crash. The fix ensures that the application does not crash by avoiding the invalid memory access. (BZ#951493) Users of glibc are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at the linked references. 5. Bugs fixed: 905874 - CVE-2013-0242 glibc: Buffer overrun (DoS) in regexp matcher by processing multibyte characters 947882 - CVE-2013-1914 glibc: Stack (frame) overflow in getaddrinfo() when processing entry mapping to long list of address structures 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: glibc on CentOS 5 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0242 1028063 http://www.securitytracker.com/id/1028063 51951 http://secunia.com/advisories/51951 55113 http://secunia.com/advisories/55113 57638 http://www.securityfocus.com/bid/57638 89747 http://osvdb.org/89747 GLSA-201503-04 https://security.gentoo.org/glsa/201503-04 MDVSA-2013:163 http://www.mandriva.com/security/advisories?name=MDVSA-2013:163 RHSA-2013:0769 http://rhn.redhat.com/errata/RHSA-2013-0769.html RHSA-2013:1605 http://rhn.redhat.com/errata/RHSA-2013-1605.html USN-1991-1 http://www.ubuntu.com/usn/USN-1991-1 [libc-alpha] 20130129 [PATCH] Fix buffer overrun in regexp matcher http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html [oss-security] 20130130 Re: CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters http://www.openwall.com/lists/oss-security/2013/01/30/5 glibc-extendbuffers-dos(81707) https://exchange.xforce.ibmcloud.com/vulnerabilities/81707 http://sourceware.org/bugzilla/show_bug.cgi?id=15078 http://www.vmware.com/security/advisories/VMSA-2014-0008.html Common Vulnerability Exposure (CVE) ID: CVE-2013-1914 20210901 SEC Consult SA-20210901-0 :: Multiple vulnerabilities in MOXA devices http://seclists.org/fulldisclosure/2021/Sep/0 52817 http://secunia.com/advisories/52817 58839 http://www.securityfocus.com/bid/58839 MDVSA-2013:283 http://www.mandriva.com/security/advisories?name=MDVSA-2013:283 MDVSA-2013:284 http://www.mandriva.com/security/advisories?name=MDVSA-2013:284 [oss-security] 20130403 CVE Request: glibc getaddrinfo() stack overflow http://www.openwall.com/lists/oss-security/2013/04/03/2 [oss-security] 20130403 Re: CVE Request: glibc getaddrinfo() stack overflow http://www.openwall.com/lists/oss-security/2013/04/03/8 [oss-security] 20130405 Re: CVE Request: glibc getaddrinfo() stack overflow http://www.openwall.com/lists/oss-security/2013/04/05/1 http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html http://sourceware.org/bugzilla/show_bug.cgi?id=15330 http://sourceware.org/git/?p=glibc.git%3Ba=commitdiff%3Bh=1cef1b19089528db11f221e938f60b9b048945d7 https://bugzilla.novell.com/show_bug.cgi?id=813121 https://bugzilla.redhat.com/show_bug.cgi?id=947882
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 144924 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.