Bugzilla – Bug 735850
VUL-0: glibc: timezone loader overflow issue
Last modified: 2015-02-18 22:06:42 UTC
is public, via oss-sec and full-disclosure http://dividead.wordpress.com/tag/heap-overflow/ http://lists.grok.org.uk/pipermail/full-disclosure/2011-December/084452.html Ok it appears although this is difficult to exploit, it can be triggered potentially allowing a security boundary to be crossed in some situations. Please use CVE-2009-5029 for this glibc timezone integer overflow issue. (Marcus: I do not think glibc is fixed yet.)
bugbot adjusting priority
Well, this is no different than any other random data corruption issue. Low prio.
*** Bug 736174 has been marked as a duplicate of this bug. ***
http://seclists.org/fulldisclosure/2011/Dec/276
http://rcvalle.com/post/14169476482/exploiting-glibc-tzfile-read-integer-overflow-to very good explanation. seems even be exploitable within vsftpd. :/
The SWAMPID for this issue is 44585. This issue was rated as important. Please submit fixed packages until 2011-12-21. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
http://rcvalle.com/post/14261796328/more-on-exploiting-glibc-tzfile-read-integer-overflow
First patch: http://sourceware.org/ml/libc-alpha/2011-12/msg00037.html
Created attachment 468032 [details] fixed upstream patch
Updates for openSUSE done: glibc 12.1: SR#97012 glibc 11.4: SR#97022 glibc 11.3: SR#97021
This is an autogenerated message for OBS integration: This bug (735850) was mentioned in https://build.opensuse.org/request/show/97012 12.1 / glibc https://build.opensuse.org/request/show/97021 11.3 / glibc https://build.opensuse.org/request/show/97022 11.4 / glibc
Update released for: glibc, glibc-32bit, glibc-debuginfo, glibc-debuginfo-32bit, glibc-debuginfo-64bit, glibc-debuginfo-x86, glibc-debugsource, glibc-devel, glibc-devel-32bit, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-locale-32bit, glibc-locale-x86, glibc-obsolete, glibc-profile, glibc-profile-32bit, glibc-profile-x86, glibc-x86, nscd Products: SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP1 (i386, x86_64) SLE-SDK 11-SP1 (i386, x86_64) SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1-TERADATA (x86_64) SLES4VMWARE 11-SP1 (i386, x86_64)
Update released for: glibc, glibc-32bit, glibc-64bit, glibc-dceext, glibc-dceext-32bit, glibc-dceext-64bit, glibc-dceext-devel, glibc-dceext-x86, glibc-debuginfo, glibc-devel, glibc-devel-32bit, glibc-devel-64bit, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-locale-32bit, glibc-locale-64bit, glibc-locale-x86, glibc-obsolete, glibc-profile, glibc-profile-32bit, glibc-profile-64bit, glibc-profile-x86, glibc-x86, nscd Products: SLE-DEBUGINFO 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-DESKTOP 10-SP4 (i386, x86_64) SLE-SDK 10-SP4 (i386, ia64, ppc, s390x, x86_64) SLE-SERVER 10-SP4 (i386, ia64, ppc, s390x, x86_64)
Update released for: glibc, glibc-32bit, glibc-dceext, glibc-dceext-32bit, glibc-dceext-devel, glibc-debuginfo, glibc-devel, glibc-devel-32bit, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-locale-32bit, glibc-obsolete, glibc-profile, glibc-profile-32bit, nscd Products: SLE-SERVER 10-SP3-TERADATA (x86_64)
Update released for: glibc, glibc-debuginfo, glibc-debuginfo-32bit, glibc-debuginfo-x86, glibc-debugsource, glibc-devel, glibc-devel-debuginfo, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-locale-debuginfo, glibc-obsolete, glibc-obsolete-debuginfo, glibc-profile, nscd, nscd-debuginfo Products: openSUSE 11.3 (debug, i586, i686, x86_64) openSUSE 11.4 (debug, i586, i686, x86_64)
This is an autogenerated message for OBS integration: This bug (735850) was mentioned in https://build.opensuse.org/request/show/99695 Evergreen:11.2 / glibc
This is an autogenerated message for OBS integration: This bug (735850) was mentioned in https://build.opensuse.org/request/show/100122 Evergreen:11.2 / glibc
Submitted to autbuild.
Update released for: glibc, glibc-devel, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-profile, nscd, timezone Products: SUSE-CORE 9-SP3-TERADATA (x86_64)
cross checked that it is contained in SLE11 SP2 at GA.
Update released for: glibc, glibc-32bit, glibc-dceext, glibc-dceext-32bit, glibc-dceext-devel, glibc-debuginfo, glibc-devel, glibc-devel-32bit, glibc-html, glibc-i18ndata, glibc-info, glibc-locale, glibc-locale-32bit, glibc-obsolete, glibc-profile, glibc-profile-32bit, nscd Products: SLE-DEBUGINFO 10-SP3 (i386, s390x, x86_64) SLE-SERVER 10-SP3-LTSS (i386, s390x, x86_64)