You are not logged in.
- Topics: Active | Unanswered
#1 2010-10-22 11:04:16
- hoschi
- Member
- From: Ulm (Germany)
- Registered: 2008-11-03
- Posts: 458
Security hole in GLIBC <= 2.12.1-2
Information (english) http://www.h-online.com/open/news/item/ … 10182.html
Information (german) http://www.heise.de/security/meldung/Ro … 10035.html
http://koji.fedoraproject.org/koji/buil … dID=201079
* Tue Oct 19 2010 Andreas Schwab <schwab@redhat.com> - 2.12.1-3 - Update from 2.12 branch - Fix strstr and memmem algorithm (BZ#12092, #641124) - Fix handling of tail bytes of buffer in SSE2/SSSE3 x86-64 version strncmp (BZ#12077) - Never expand $ORIGIN in privileged programs (#643306, CVE-2010-3847)
Archlinux uses currently 2.12.1-2
And this looks like maybe?
I think we should update to 2.12.1-3, should be a save decision?
Last edited by hoschi (2010-10-22 12:16:47)
Offline
#2 2010-10-22 11:33:30
- Allan
- Pacman
- From: Brisbane, AU
- Registered: 2007-06-09
- Posts: 11,400
- Website
Re: Security hole in GLIBC <= 2.12.1-2
-2 and -3 are distro specfic. Fedora versions mean nothing to us.
Offline
#3 2010-10-22 11:39:44
- hoschi
- Member
- From: Ulm (Germany)
- Registered: 2008-11-03
- Posts: 458
Re: Security hole in GLIBC <= 2.12.1-2
Well. Okay.
But we don't know why the bug (in this form) doesn't work?
So I think a new build with the $ORIGIN-Fix whould be a sane decision?
Offline
#4 2010-10-22 11:49:21
- Allan
- Pacman
- From: Brisbane, AU
- Registered: 2007-06-09
- Posts: 11,400
- Website
Offline
#5 2010-10-22 12:03:33
- hoschi
- Member
- From: Ulm (Germany)
- Registered: 2008-11-03
- Posts: 458
Re: Security hole in GLIBC <= 2.12.1-2
Using this fix and knowing that it is correctly fixed seems to be better, than not using the fix and don't know why only this lonely exploit doesn't work.
In other words, I prefer knowing over believing.
btw. In normal case the currenct fix will be included in next major release anyway
Offline
#6 2010-10-22 12:04:16
- Pierre
- Developer
- From: Bonn
- Registered: 2004-07-05
- Posts: 1,964
- Website
Re: Security hole in GLIBC <= 2.12.1-2
The links you provided are mainly about the linux kernel exploit and the glibc bug is only mentioned at the end. The kernel bug is not fixed yet though.
Offline
#7 2010-10-22 12:06:54
- ber_t
- Member
- From: Berlin, Germany
- Registered: 2010-03-10
- Posts: 214
- Website
Re: Security hole in GLIBC <= 2.12.1-2
Is it already clear, that the bug isn't in arch's glibc or does the given exploit simply not work under arch?
Offline
#8 2010-10-22 12:09:28
- wonder
- Developer
- From: Bucharest, Romania
- Registered: 2006-07-05
- Posts: 5,941
- Website
Re: Security hole in GLIBC <= 2.12.1-2
@hoschi did you tried to exploit an arch system which is up to date?
Give what you have. To someone, it may be better than you dare to think.
Offline
#9 2010-10-22 12:13:45
- Allan
- Pacman
- From: Brisbane, AU
- Registered: 2007-06-09
- Posts: 11,400
- Website
Re: Security hole in GLIBC <= 2.12.1-2
btw. In normal case the currenct fix will be included in next major release anyway
Well, it has not been committed to the glibc git repo yet... if it get put into the glibc-2.12 branch, I will do the rebuild.
Offline
#10 2010-10-22 12:15:41
- hoschi
- Member
- From: Ulm (Germany)
- Registered: 2008-11-03
- Posts: 458
Re: Security hole in GLIBC <= 2.12.1-2
The links you provided are mainly about the linux kernel exploit and the glibc bug is only mentioned at the end. The kernel bug is not fixed yet though.
Offline
#11 2010-10-22 12:20:58
- hoschi
- Member
- From: Ulm (Germany)
- Registered: 2008-11-03
- Posts: 458
Re: Security hole in GLIBC <= 2.12.1-2
hoschi wrote:btw. In normal case the currenct fix will be included in next major release anyway
Well, it has not been committed to the glibc git repo yet... if it get put into the glibc-2.12 branch, I will do the rebuild.
That sounds fine! I tought it is now in the glibc-2.12-branch. Fail...
I think that Andreas Schwab is member of the GLIBC-Crew. So I thought if he put the fix in fedora the fix is "automatic" also in the glibc-branch.
So you think the security hole itself is maybe caused by "special whatever additions or fixes" from fedora and other distros?
Last edited by hoschi (2010-10-22 12:23:51)
Offline
#12 2010-10-22 12:32:22
- Allan
- Pacman
- From: Brisbane, AU
- Registered: 2007-06-09
- Posts: 11,400
- Website
Re: Security hole in GLIBC <= 2.12.1-2
It is not even on the master branch...
Offline
#13 2010-10-22 12:35:45
- combuster
- Member
- From: Serbia
- Registered: 2008-09-30
- Posts: 711
- Website
Re: Security hole in GLIBC <= 2.12.1-2
http://seclists.org/fulldisclosure/2010/Oct/257
http://www.vsecurity.com/resources/advisory/20101019-1/
The other one is a kernel bug and it has been fixed in 2.6.36
Offline