GNU GLibC以不安全方式创建临时文件漏洞

admin

0
文章

0
评论

2022-07-12 10:21:07 CNNVD漏洞来源：ZONE.CI 全球网 0 阅读模式

漏洞信息详情

GNU GLibC以不安全方式创建临时文件漏洞

CNNVD编号：CNNVD-200502-031
危害等级：低危
CVE编号： CVE-2004-0968
漏洞类型：设计错误
发布时间： 2004-09-30
威胁类型：本地
更新时间： 2005-10-20
厂商： gnu
漏洞来源： Trustix

漏洞简介

glibc是绝大多数Linux操作系统中C库的实现。 GNU GLibC不安全建立临时文件，本地攻击者可以利用这个漏洞破坏系统文件，进行拒绝服务攻击。问题是由于应用程序在写临时文件时没有正确验证文件是否存在，攻击者利用此漏洞可以当前用户进程权限覆盖任意系统文件，可造成一定的拒绝服务。目前看起来不能利用此漏洞进行权限提升。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接： GNU glibc 2.1.3 Trustix glibc-2.1.3-23tr.i586.rpm Trustix Secure Linux 1.5 ftp://ftp.trustix.org/pub/trustix/updates/ Trustix glibc-devel-2.1.3-23tr.i586.rpm Trustix Secure Linux 1.5 ftp://ftp.trustix.org/pub/trustix/updates/ Trustix glibc-profile-2.1.3-23tr.i586.rpm Trustix Secure Linux 1.5 ftp://ftp.trustix.org/pub/trustix/updates/ GNU glibc 2.2.5 Debian glibc-doc_2.2.5-11.8_all.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.2.5-1 1.8_all.deb Debian libc6-dbg_2.2.5-11.8_arm.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_arm.deb Debian libc6-dbg_2.2.5-11.8_hppa.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_hppa.deb Debian libc6-dbg_2.2.5-11.8_i386.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_i386.deb Debian libc6-dbg_2.2.5-11.8_m68k.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_m68k.deb Debian libc6-dbg_2.2.5-11.8_mips.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_mips.deb Debian libc6-dbg_2.2.5-11.8_mipsel.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_mipsel.deb Debian libc6-dbg_2.2.5-11.8_powerpc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_powerpc.deb Debian libc6-dbg_2.2.5-11.8_s390.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_s390.deb Debian libc6-dbg_2.2.5-11.8_sparc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.2.5-1 1.8_sparc.deb Debian libc6-dev-sparc64_2.2.5-11.8_sparc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev-sparc64 _2.2.5-11.8_sparc.deb Debian libc6-dev_2.2.5-11.8_arm.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_arm.deb Debian libc6-dev_2.2.5-11.8_hppa.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_hppa.deb Debian libc6-dev_2.2.5-11.8_i386.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_i386.deb Debian libc6-dev_2.2.5-11.8_m68k.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_m68k.deb Debian libc6-dev_2.2.5-11.8_mips.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_mips.deb Debian libc6-dev_2.2.5-11.8_mipsel.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_mipsel.deb Debian libc6-dev_2.2.5-11.8_powerpc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_powerpc.deb Debian libc6-dev_2.2.5-11.8_s390.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_s390.deb Debian libc6-dev_2.2.5-11.8_sparc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.2.5-1 1.8_sparc.deb Debian libc6-pic_2.2.5-11.8_arm.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_arm.deb Debian libc6-pic_2.2.5-11.8_hppa.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_hppa.deb Debian libc6-pic_2.2.5-11.8_i386.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_i386.deb Debian libc6-pic_2.2.5-11.8_m68k.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_m68k.deb Debian libc6-pic_2.2.5-11.8_mips.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_mips.deb Debian libc6-pic_2.2.5-11.8_mipsel.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_mipsel.deb Debian libc6-pic_2.2.5-11.8_powerpc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_powerpc.deb Debian libc6-pic_2.2.5-11.8_s390.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_s390.deb Debian libc6-pic_2.2.5-11.8_sparc.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.2.5-1 1.8_sparc.deb Debian libc6-prof_2.2.5-11.8_arm.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5- 11.8_arm.deb Debian libc6-prof_2.2.5-11.8_hppa.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5- 11.8_hppa.deb Debian libc6-prof_2.2.5-11.8_i386.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5- 11.8_i386.deb Debian libc6-prof_2.2.5-11.8_m68k.deb Debian GNU/Linux 3.0 alias woody http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.2.5- 11.8_m68k.deb

参考网址

来源: BID 名称: 11286 链接:http://www.securityfocus.com/bid/11286 来源: XF 名称: script-temporary-file-overwrite(17583) 链接:http://xforce.iss.net/xforce/xfdb/17583 来源: TRUSTIX 名称: 2004-0050 链接:http://www.trustix.org/errata/2004/0050 来源: REDHAT 名称: RHSA-2005:261 链接:http://www.redhat.com/support/errata/RHSA-2005-261.HTML 来源: REDHAT 名称: RHSA-2004:586 链接:http://www.redhat.com/support/errata/RHSA-2004-586.HTML 来源: DEBIAN 名称: DSA-636 链接:http://www.debian.org/security/2005/dsa-636 来源: GENTOO 名称: GLSA-200410-19 链接:http://security.gentoo.org/glsa/glsa-200410-19.xml 来源: bugzilla.redhat.com 链接:http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136318 来源: UBUNTU 名称: USN-4-1 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109899903129801&w=2