Multiple Vendors libc/glob(3) resource exhaustion

BruceLee · **Posted:** Thu Oct 07, 2010 6:19 am

I don't exactly know if the centos/redhat GNU Libc (glibc) is also affected but since it seems pretty ugly I post it.
Maybe Atomicorp can verify it.
Thanks

http://securityreason.com/securityalert/7822

mikeshinn · **Posted:** Thu Oct 07, 2010 3:56 pm

I dont see any alerts from Centos or Redhat for this:

https://www.redhat.com/security/data/cve/cve-2010.html

So far it does not appear to effect Linux in my testing. In proftp it will kick back a OOM, clean itself up and keep on trucking without hurting itself or the server either:

ftp> ls */../*/../*/../*/../*/../*/../*
227 Entering Passive Mode (127,0,0,1,148,53).
150 Opening BINARY mode data connection for file list
226-Out of memory during globbing of */../*/../*/../*/../*/../*/../*
226 Transfer complete
ftp> ls
227 Entering Passive Mode (127,0,0,1,223,203).
150 Opening BINARY mode data connection for file list
-rw------- 1 mshinn mshinn 390588 Apr 21 13:02 test_junk

The PHP test also fails to do anything bad on Linux.

BruceLee · **Posted:** Thu Oct 07, 2010 4:56 pm

Thank for the quick verification Mike. Great service like always.

webfeatus · **Posted:** Mon Oct 18, 2010 10:07 pm

(worried)

Is it OK to run this update on Centos v5?
Anyone seen any problems?

Code:

Updating:
 glibc                                        i686                     2.5-49.el5_5.5                             updates                     5.3 M
 glibc-common                                 i386                     2.5-49.el5_5.5                             updates                      16 M
 glibc-devel                                  i386                     2.5-49.el5_5.5                             updates                     2.0 M
 glibc-headers                                i386                     2.5-49.el5_5.5                             updates                     602 k
 java-1.6.0-openjdk                           i386                     1:1.6.0.0-1.16.b17.el5                     updates                      37 M
 java-1.6.0-openjdk-devel                     i386                     1:1.6.0.0-1.16.b17.el5                     updates                      12 M
 logrotate                                    i386                     3.7.4-9.el5_5.1                            updates                      40 k
 nscd                                         i386                     2.5-49.el5_5.5                             updates                     165 k

mikeshinn · **Posted:** Tue Oct 19, 2010 10:45 pm

glibc and nscd are fine, cant speak to java - dont use it.

Multiple Vendors libc/glob(3) resource exhaustion

Who is online