Notified: July 08, 2002 Updated: August 13, 2002
Affected
Please see Caldera Security Advisory CSSA-2002-034.1 (OpenLinux).
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 14, 2002
Affected
Conectiva Linux supported versions (6.0, 7.0 and 8) are not vulnerable to VU#803539 regarding glibc packages. Regarding VU#542971, these same versions of Conectiva Linux are vulnerable but not in the default installation, since /etc/nsswitch.conf ships without the dns parameter in the "networks:" line. Updated glibc packages which fix the second vulnerability, VU#542971, will be provided.
The vendor has not provided us with any further information regarding this vulnerability.
Please see Conectiva Linux Announcement CLSA-2002:507 (english).
Notified: July 08, 2002 Updated: August 14, 2002
Affected
Debian is vulnerable to the second vulnerability [VU#542971]:
Debian 2.2 aka potato aka stable: glibc 2.1.3 does not contain the included patch Debian woody aka testing: glibc 2.2.5 does not contain the included patch Debian sid aka unstable: glibc 2.2.5 does not contain the included patchWe are working towards an updated library. We are not vulnerable to the first vulnerability [VU#803539] as published in the CERT Advisory CA-2002-19, though.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: June 28, 2002 Updated: August 01, 2002
Affected
For resolving host names and addresses via DNS, Version 2.1.2 and earlier versions of the GNU C Library are vulnerable. Later versions are not vulnerable. For the less commonly used action of resolving network names and addresses via DNS as per Internet RFC 1011, Version 2.2.5 and earlier versions are vulnerable. To work around the problems, modify the file /etc/nsswitch.conf so that it contains "hosts:" and "networks:" lines that do not mention "dns". For example, you might use the following lines in your /etc/nsswitch.conf file: # This "networks:" line omits "dns" to work around a bug in glibc
# 2.2.5 and earlier. networks: files nisplus # This "hosts:" line omits "dns" to work around a bug in glibc 2.1.2
# and earlier. hosts: nisplus [NOTFOUND=return] files
[CERT/CC: This workaround will break network and host resolution that is not provided through some other means, such as database files (/etc/hosts, /etc/networks) or NIS. In most cases, resolution for non-local networks and hosts will be disabled.]
Most GNU/Linux distributions with glibc 2.1.3 and later ship with a line like "networks: files" in /etc/nsswitch.conf and thus unless this line is changed they are not vulnerable. To fix the problem instead of working around it, we suggest upgrading to Version 2.1.3 or later, and applying the following patch, taking care to relink any statically linked applications that use the affected functions. This patch can also be found at:
The vendor has not provided us with any further information regarding this vulnerability.
One aspect of this vulnerability that involves host name and address lookups was addressed in glibc version 2.1.3 in October 1999: [ftp://ftp.gnu.org/gnu/glibc/glibc-2.1.2-2.1.3.diff.gz] +1999-10-25 Ulrich Drepper
Notified: July 08, 2002 Updated: August 01, 2002
Affected
Please see EnGarde Secure Linux Security Advisory ESA-20020724-018.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: July 08, 2002 Updated: August 01, 2002
Affected
Please see Hewlett-Packard Company Security Bulletin HPSBTL0207-053.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: July 08, 2002 Updated: August 01, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: July 08, 2002 Updated: August 14, 2002
Affected
Please see MandrakeSoft Security Advisory MDKSA-2002:050.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 14, 2002
Affected
No release or branch of Openwall GNU/*/Linux (Owl) is affected in default configuration as the "dns" NSS module isn't enabled for network lookups in our default /etc/nsswitch.conf file. The defect in "dns" module has been corrected in Owl-current on 2002/07/04 and that fix is included in the snapshot from 2002/07/07.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: July 08, 2002 Updated: August 01, 2002
Affected
Please see Red Hat Security Advisory RHSA-2002:139-10.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Notified: July 08, 2002 Updated: August 01, 2002
Unknown
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 13, 2002
Affected
No statement is currently available from the vendor regarding this vulnerability.
The vendor has not provided us with any further information regarding this vulnerability.
Slackware changelogs reflect patches to glibc libraries: ftp://ftp.slackware.com/pub/slackware/slackware-current/ChangeLog.txt ftp://ftp.slackware.com/pub/slackware/slackware-8.1/ChangeLog.txt Tue Jul 30 19:45:52 PDT 2002 (* Security fix *) patches/packages/glibc-2.2.5-i386-3.tgz: Patched to fix a buffer overflow in glibc's DNS resolver functions that look up network addresses. Another workaround for this problem is to edit /etc/nsswtich.conf changing: networks: files dns to: networks: files (* Security fix *) patches/packages/glibc-solibs-2.2.5-i386-3.tgz: Patched to fix a buffer overflow in glibc's DNS resolver functions that look up network addresses.
Notified: July 08, 2002 Updated: August 01, 2002
Affected
-----BEGIN PGP SIGNED MESSAGE----- SuSE Security Announcement Package: bind, glibc
Announcement-ID: SuSE-SA:2002:026
Date: Tue Jul 09 2002
Affected products: 7.0, 7.1, 7.2, 7.3, 8.0
SuSE Linux Enterprise Server for S/390,
SuSE Linux Database Server,
SuSE eMail Server III,
SuSE Linux Enterprise Server,
SuSE Linux Firewall on CD
Vulnerability Type: buffer overflow
Severity (1-10): 3
SuSE default package: yes
Cross References: CERT CA-2002-19; CVE CAN-2002-0651 Content of this advisory: 1) security vulnerability resolved: buffer overflow in
dig, host, and nslookup utilities. problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information) 1) problem description, brief discussion, solution, upgrade information A vulnerability has been discovered in some resolver library
functions. The affected code goes back to the resolver library
shipped as part of BIND4; code derived from it has been included
in later BIND releases as well as the GNU libc. The bug itself is a buffer overflow that can be triggered if a
DNS server sends multiple CNAME records in a DNS response. This bug has been fixed for the gethostbyXXX class of functions
in GNU libc in 1999. Unfortunately, there is similar code in the
getnetbyXXX functions in recent glibc implementations, and
the code is enabled by default. However, these functions are
used by very few applications only, such as ifconfig and ifuser,
which makes exploits less likely. We will make updated glibc packages available as they have gone
through our build system, but without separate announcements. Until glibc patches are available, we recommend that you disable
DNS lookups of network names in nsswitch.conf. Simply replace the
line containing the tag "networks:" with this line: networks: files In the unlikely event that you've configured any name to network
mapping via DNS, make sure you copy this information to
/etc/networks. The resolver bug is also present in the libbind library included
in BIND. This library is used by utilities from the bindutil package. We are therefore providing security updates for bind8 that
address this vulnerability. As communicated previously (1),
the SuSE security team is not providing fixes for BIND4 anymore. The bind9 packages shipped by SuSE are not vulnerable. Please download the update package for your distribution and
verify its integrity by the methods listed in section 3) of this
announcement. Apply the updata packages (bindutil, bind8) package using rpm -Fvh bind*.rpm If you are running the BIND name server, you should restart the name
server process by issuing rcnamed restart Our maintenance customers are being notified individually. The
packages are being offered to install from the maintenance web. References: (1) http://www.suse.de/de/support/security/adv004_ssh.html 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - There is a format string bug in the "nn" news reader that can
be exploited by a malicious NNTP server to execute arbitrary
commands within the client user's account. We will be releasing
updated packages. 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command
md5sum
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.
Updated: August 14, 2002
Affected
Please see Trustix Secure Linux Security Advisory #2002-0061 (BIND) and #2002-0067 (glibc).
The vendor has not provided us with any further information regarding this vulnerability.
The CERT/CC has no additional comments at this time.