all things security
Showing 1 - 14 of 14 RSS Feed

CVE-2017-1000366

Status Candidate

Overview

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Related Files

Red Hat Security Advisory 2017-1712-01
Posted Jul 6, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1712-01 - Red Hat 3scale API Management Platform 2.0 is a platform for the management of access and traffic for web-based APIs across a variety of deployment options. Security Fix: It was found that RH-3scale AMP would permit creation of an access token without a client secret. An attacker could use this flaw to circumvent authentication controls and gain access to restricted APIs. The underlying container image was also rebuilt to resolve other security issues.

tags | advisory, web
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502, CVE-2017-7512
MD5 | 956dddcd24d616d3e3eb9855a25dca7e
Slackware Security Advisory - glibc Updates
Posted Jul 3, 2017
Authored by Slackware Security Team | Site slackware.com

Slackware Security Advisory - New glibc packages are available for Slackware 14.2 and -current to fix security issues.

tags | advisory
systems | linux, slackware
advisories | CVE-2017-1000366
MD5 | 5f5ee8379c5e8b409a33219c34ff0537
Linux Kernel ldso_dynamic Stack Clash Privilege Escalation
Posted Jun 30, 2017
Site qualys.com

Linux kernel ldso_dynamic stack clash privilege escalation exploit. This affects Debian 9/10, Ubuntu 14.04.5/16.04.2/17.04, and Fedora 23/24/25.

tags | exploit, kernel
systems | linux, debian, fedora, ubuntu
advisories | CVE-2017-1000366, CVE-2017-1000371
MD5 | 26e7fd3397117950b21fa67eb23afc32
Linux Kernel ldso_hwcap_64 Stack Clash Privilege Escalation
Posted Jun 30, 2017
Site qualys.com

Linux kernel ldso_hwcap_64 stack clash privilege escalation exploit. This affects Debian 7.7/8.5/9.0, Ubuntu 14.04.2/16.04.2/17.04, Fedora 22/25, and CentOS 7.3.1611.

tags | exploit, kernel
systems | linux, debian, fedora, ubuntu, centos
advisories | CVE-2017-1000366, CVE-2017-1000379
MD5 | 0807adfea74deef734fd4ac194527b9c
Ubuntu Security Notice USN-3323-2
Posted Jun 30, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3323-2 - USN-3323-1 fixed a vulnerability in the GNU C Library. This update provides the corresponding update for Ubuntu 12.04 ESM. It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in combination with another vulnerability to gain administrative privileges. Various other issues were also addressed.

tags | advisory, local
systems | linux, ubuntu
advisories | CVE-2017-1000366
MD5 | a78b5e8caa51c4d2d2fa51e3fe96b76a
Linux Kernel ldso_hwcap Stack Clash Privilege Escalation
Posted Jun 29, 2017
Site qualys.com

Linux kernel ldso_hwcap stack clash privilege escalation exploit. This affects Debian 7/8/9/10, Fedora 23/24/25, and CentOS 5.3/5.11/6.0/6.8/7.2.1511.

tags | exploit, kernel
systems | linux, debian, fedora, centos
advisories | CVE-2017-1000366, CVE-2017-1000370
MD5 | d6f12ceef7446a165164528e21c0b625
Red Hat Security Advisory 2017-1567-01
Posted Jun 21, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1567-01 - Red Hat Container Development Kit is a platform for developing containerized applicationsaaait is a set of tools that enables developers to quickly and easily set up an environment for developing and testing containerized applications on the Red Hat Enterprise Linux platform. With this update, Container Development Kit has been updated to 3.0.0-2, which includes an updated Red Hat Enterprise Linux ISO that contains fixes for the following security issues. Multiple security issues have been addressed.

tags | advisory
systems | linux, redhat
advisories | CVE-2017-1000364, CVE-2017-1000366, CVE-2017-7502
MD5 | db61fe9d6bab1e49dcbb4100de883474
Gentoo Linux Security Advisory 201706-19
Posted Jun 20, 2017
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory 201706-19 - Multiple vulnerabilities have been found in the GNU C Library, the worst of which may allow execution of arbitrary code. Versions less than 2.23-r4 are affected.

tags | advisory, arbitrary, vulnerability
systems | linux, gentoo
advisories | CVE-2015-5180, CVE-2016-6323, CVE-2017-1000366
MD5 | 6f51e1fee26361684ccab503de218c9f
Qualys Security Advisory - The Stack Clash
Posted Jun 20, 2017
Site qualys.com

Qualys has released a large amount of research surrounding the use of stack clash vulnerabilities and how stack guard on Linux can be bypassed.

tags | advisory, vulnerability
systems | linux
advisories | CVE-2017-1000369, CVE-2017-1000376, CVE-2017-1000366, CVE-2017-1000370, CVE-2010-2240, CVE-2017-1000365, CVE-2017-1000372, CVE-2017-1000373, CVE-2017-1083, CVE-2017-1082, CVE-2016-3672, CVE-2017-1000371
MD5 | 91191a0fae00196fec218203d9999e82
Red Hat Security Advisory 2017-1481-01
Posted Jun 19, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1481-01 - The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.

tags | advisory
systems | linux, redhat, osx
advisories | CVE-2017-1000366
MD5 | 26d01b92643e1ee3f841e2985d2bd969
Red Hat Security Advisory 2017-1480-01
Posted Jun 19, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1480-01 - The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.

tags | advisory
systems | linux, redhat, osx
advisories | CVE-2017-1000366
MD5 | bc110fd2c8a3043c369b7e62c2057b17
Red Hat Security Advisory 2017-1479-01
Posted Jun 19, 2017
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-1479-01 - The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix: A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process stack or the adjacent memory region, and thus increase their privileges on the system. This is glibc-side mitigation which blocks processing of LD_LIBRARY_PATH for programs running in secure-execution mode and reduces the number of allocations performed by the processing of LD_AUDIT, LD_PRELOAD, and LD_HWCAP_MASK, making successful exploitation of this issue more difficult.

tags | advisory
systems | linux, redhat, osx
advisories | CVE-2017-1000366
MD5 | 96ed8575b1f88bcd28d167a8cb15d9b2
Debian Security Advisory 3887-1
Posted Jun 19, 2017
Authored by Debian | Site debian.org

Debian Linux Security Advisory 3887-1 - The Qualys Research Labs discovered various problems in the dynamic linker of the GNU C Library which allow local privilege escalation by clashing the stack.

tags | advisory, local
systems | linux, debian
advisories | CVE-2017-1000366
MD5 | 0e67c7586caaf0743100d67a304537cb
Ubuntu Security Notice USN-3323-1
Posted Jun 19, 2017
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3323-1 - It was discovered that the GNU C library did not properly handle memory when processing environment variables for setuid programs. A local attacker could use this in combination with another vulnerability to gain administrative privileges.

tags | advisory, local
systems | linux, ubuntu
advisories | CVE-2017-1000366
MD5 | 4f1f7e02e2084f735fd97a042a1859cf
Page 1 of 1
Back1Next

File Archive:

October 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    15 Files
  • 2
    Oct 2nd
    16 Files
  • 3
    Oct 3rd
    15 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    11 Files
  • 6
    Oct 6th
    6 Files
  • 7
    Oct 7th
    2 Files
  • 8
    Oct 8th
    1 Files
  • 9
    Oct 9th
    13 Files
  • 10
    Oct 10th
    16 Files
  • 11
    Oct 11th
    15 Files
  • 12
    Oct 12th
    23 Files
  • 13
    Oct 13th
    13 Files
  • 14
    Oct 14th
    12 Files
  • 15
    Oct 15th
    2 Files
  • 16
    Oct 16th
    16 Files
  • 17
    Oct 17th
    16 Files
  • 18
    Oct 18th
    15 Files
  • 19
    Oct 19th
    10 Files
  • 20
    Oct 20th
    7 Files
  • 21
    Oct 21st
    4 Files
  • 22
    Oct 22nd
    2 Files
  • 23
    Oct 23rd
    10 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close