Test ID:	1.3.6.1.4.1.25623.1.0.881722
Category:	CentOS Local Security Checks
Title:	CentOS Update for glibc CESA-2013:0769 centos5
Summary:	The remote host is missing an update for the 'glibc'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'glibc' package(s) announced via the referenced advisory. Vulnerability Insight: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash. (CVE-2013-1914) A flaw was found in the regular expression matching routines that process multibyte character input. If an application utilized the glibc regular expression matching mechanism, an attacker could provide specially-crafted input that, when processed, would cause the application to crash. (CVE-2013-0242) This update also fixes the following bugs: * The improvements RHSA-2012:1207 made to the accuracy of floating point functions in the math library caused performance regressions for those functions. The performance regressions were analyzed and a fix was applied that retains the current accuracy but reduces the performance penalty to acceptable levels. Refer to Red Hat Knowledge solution 229993, linked to in the References, for further information. (BZ#950535) * It was possible that a memory location freed by the localization code could be accessed immediately after, resulting in a crash. The fix ensures that the application does not crash by avoiding the invalid memory access. (BZ#951493) Users of glibc are advised to upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at the linked references. 5. Bugs fixed: 905874 - CVE-2013-0242 glibc: Buffer overrun (DoS) in regexp matcher by processing multibyte characters 947882 - CVE-2013-1914 glibc: Stack (frame) overflow in getaddrinfo() when processing entry mapping to long list of address structures 6. Package List: Red Hat Enterprise Linux Desktop (v. 5 client): Source: ... Description truncated, please see the referenced URL(s) for more information. Affected Software/OS: glibc on CentOS 5 Solution: Please install the updated packages. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0242 BugTraq ID: 57638 http://www.securityfocus.com/bid/57638 https://security.gentoo.org/glsa/201503-04 http://www.mandriva.com/security/advisories?name=MDVSA-2013:163 http://sourceware.org/bugzilla/show_bug.cgi?id=15078 http://sourceware.org/ml/libc-alpha/2013-01/msg00967.html http://www.openwall.com/lists/oss-security/2013/01/30/5 http://osvdb.org/89747 RedHat Security Advisories: RHSA-2013:0769 http://rhn.redhat.com/errata/RHSA-2013-0769.html RedHat Security Advisories: RHSA-2013:1605 http://rhn.redhat.com/errata/RHSA-2013-1605.html http://www.securitytracker.com/id/1028063 http://secunia.com/advisories/51951 http://secunia.com/advisories/55113 http://www.ubuntu.com/usn/USN-1991-1 XForce ISS Database: glibc-extendbuffers-dos(81707) https://exchange.xforce.ibmcloud.com/vulnerabilities/81707 Common Vulnerability Exposure (CVE) ID: CVE-2013-1914 BugTraq ID: 58839 http://www.securityfocus.com/bid/58839 http://seclists.org/fulldisclosure/2021/Sep/0 http://www.mandriva.com/security/advisories?name=MDVSA-2013:283 http://www.mandriva.com/security/advisories?name=MDVSA-2013:284 http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html https://bugzilla.novell.com/show_bug.cgi?id=813121 https://bugzilla.redhat.com/show_bug.cgi?id=947882 http://www.openwall.com/lists/oss-security/2013/04/03/2 http://www.openwall.com/lists/oss-security/2013/04/03/8 http://www.openwall.com/lists/oss-security/2013/04/05/1 http://secunia.com/advisories/52817
Copyright	Copyright (c) 2013 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.