Synopsis: Updated glibc packages fix various issues
Advisory ID: RHSA-2003:249-01
Issue date: 2003-08-22
Updated on: 2003-08-22
Product: Red Hat Enterprise Linux
Keywords: linuxthreads_db debugging threads malloc barrier
Cross references:
Obsoletes: RHSA-2003:090
CVE Names:
CAN-2003-0689
- ---------------------------------------------------------------------
1. Topic:
Updated glibc packages that fix a number of bugs as well as a buffer
overflow issue are now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, i686, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386, i686
Red Hat Enterprise Linux WS version 2.1 - i386, i686
3. Problem description:
The GNU libc package (known as glibc) contains the standard C libraries
used by applications.
A bug in the getgrouplist function can cause a buffer overflow if
the size of the group list is too small to hold all the user's groups.
This overflow can cause segmentation faults in user applications, which may
have security implications, depending on the application in question. This
vulnerability exists only when an administrator has placed a user in a
number of groups larger than that expected by an application. Therefore,
there is no risk in instances where users are members of few groups. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name
CAN-2003-0689 to this issue.
In addition, a number of other bugs in glibc have been fixed:
- - An error prevented gdb from correctly debugging programs linked to
libpthread.
- - A race condition existed in the malloc routine for IA64 platforms, which
could cause memory corruption.
- - An error in pthread_spinlocks prevents spinlocks from functioning
correctly on IA64 platforms.
All users should upgrade to these errata packages, which contain patches to
the glibc libraries correcting these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.
Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (
http://bugzilla.redhat.com/bugzilla for more info):
82640 - Gdb unable to debug threaded apps
90672 - RHEL 3 and RHELAS2.1 QU3 IPF errata: Corrupted linked list due to memory ordering issues
101998 - Broken pthread_spinlocks
101691 - Buffer overrun in getgrouplist function in initgroups.c
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
i386:
Available from Red Hat Network: glibc-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-common-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-devel-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-profile-2.2.4-32.8.i386.rpm
Available from Red Hat Network: nscd-2.2.4-32.8.i386.rpm
i686:
Available from Red Hat Network: glibc-2.2.4-32.8.i686.rpm
ia64:
Available from Red Hat Network: glibc-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-common-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-devel-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-profile-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: nscd-2.2.4-32.8.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
ia64:
Available from Red Hat Network: glibc-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-common-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-devel-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: glibc-profile-2.2.4-32.8.ia64.rpm
Available from Red Hat Network: nscd-2.2.4-32.8.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
i386:
Available from Red Hat Network: glibc-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-common-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-devel-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-profile-2.2.4-32.8.i386.rpm
Available from Red Hat Network: nscd-2.2.4-32.8.i386.rpm
i686:
Available from Red Hat Network: glibc-2.2.4-32.8.i686.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
i386:
Available from Red Hat Network: glibc-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-common-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-devel-2.2.4-32.8.i386.rpm
Available from Red Hat Network: glibc-profile-2.2.4-32.8.i386.rpm
Available from Red Hat Network: nscd-2.2.4-32.8.i386.rpm
i686:
Available from Red Hat Network: glibc-2.2.4-32.8.i686.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
779b9371ed6f3df44413d43439aedcdb 2.1AS/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
a45f96f4d14dc6a7411699dae7929c2b 2.1AS/en/os/i386/glibc-2.2.4-32.8.i386.rpm
4307ee9036a34fc75ac369b54560e8b8 2.1AS/en/os/i386/glibc-common-2.2.4-32.8.i386.rpm
d2a171dc3f0e406acb3089edc70add67 2.1AS/en/os/i386/glibc-devel-2.2.4-32.8.i386.rpm
ed1d806491ef9bc28f435a7e6c8c8392 2.1AS/en/os/i386/glibc-profile-2.2.4-32.8.i386.rpm
7ada51ed827ebc1091f05c83186f0597 2.1AS/en/os/i386/nscd-2.2.4-32.8.i386.rpm
ef0c8b62114ffdde63dafd6253c7e9d1 2.1AS/en/os/i686/glibc-2.2.4-32.8.i686.rpm
3001471f06cdeb6dbe12a2dca31401a5 2.1AS/en/os/ia64/glibc-2.2.4-32.8.ia64.rpm
55f60657c2b2f320e2393f6441de56a2 2.1AS/en/os/ia64/glibc-common-2.2.4-32.8.ia64.rpm
6e359bee323035b993214b6bfb89e903 2.1AS/en/os/ia64/glibc-devel-2.2.4-32.8.ia64.rpm
b17a6bdc87d729cd39b767694cdb8a26 2.1AS/en/os/ia64/glibc-profile-2.2.4-32.8.ia64.rpm
74d03cd22fe036b2f181d3f6528b97fa 2.1AS/en/os/ia64/nscd-2.2.4-32.8.ia64.rpm
779b9371ed6f3df44413d43439aedcdb 2.1AW/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
3001471f06cdeb6dbe12a2dca31401a5 2.1AW/en/os/ia64/glibc-2.2.4-32.8.ia64.rpm
55f60657c2b2f320e2393f6441de56a2 2.1AW/en/os/ia64/glibc-common-2.2.4-32.8.ia64.rpm
6e359bee323035b993214b6bfb89e903 2.1AW/en/os/ia64/glibc-devel-2.2.4-32.8.ia64.rpm
b17a6bdc87d729cd39b767694cdb8a26 2.1AW/en/os/ia64/glibc-profile-2.2.4-32.8.ia64.rpm
74d03cd22fe036b2f181d3f6528b97fa 2.1AW/en/os/ia64/nscd-2.2.4-32.8.ia64.rpm
779b9371ed6f3df44413d43439aedcdb 2.1ES/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
a45f96f4d14dc6a7411699dae7929c2b 2.1ES/en/os/i386/glibc-2.2.4-32.8.i386.rpm
4307ee9036a34fc75ac369b54560e8b8 2.1ES/en/os/i386/glibc-common-2.2.4-32.8.i386.rpm
d2a171dc3f0e406acb3089edc70add67 2.1ES/en/os/i386/glibc-devel-2.2.4-32.8.i386.rpm
ed1d806491ef9bc28f435a7e6c8c8392 2.1ES/en/os/i386/glibc-profile-2.2.4-32.8.i386.rpm
7ada51ed827ebc1091f05c83186f0597 2.1ES/en/os/i386/nscd-2.2.4-32.8.i386.rpm
ef0c8b62114ffdde63dafd6253c7e9d1 2.1ES/en/os/i686/glibc-2.2.4-32.8.i686.rpm
779b9371ed6f3df44413d43439aedcdb 2.1WS/en/os/SRPMS/glibc-2.2.4-32.8.src.rpm
a45f96f4d14dc6a7411699dae7929c2b 2.1WS/en/os/i386/glibc-2.2.4-32.8.i386.rpm
4307ee9036a34fc75ac369b54560e8b8 2.1WS/en/os/i386/glibc-common-2.2.4-32.8.i386.rpm
d2a171dc3f0e406acb3089edc70add67 2.1WS/en/os/i386/glibc-devel-2.2.4-32.8.i386.rpm
ed1d806491ef9bc28f435a7e6c8c8392 2.1WS/en/os/i386/glibc-profile-2.2.4-32.8.i386.rpm
7ada51ed827ebc1091f05c83186f0597 2.1WS/en/os/i386/nscd-2.2.4-32.8.i386.rpm
ef0c8b62114ffdde63dafd6253c7e9d1 2.1WS/en/os/i686/glibc-2.2.4-32.8.i686.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2003-0689
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/Roe/XlSAg2UNWIIRAiybAJ9OwKUsThNyHM+bU/pcntbHUsHGcgCgqiTi
7LdYF+tq7iGZZSpg8KlP0mA=
=tWcg
-----END PGP SIGNATURE-----
