PT-2004-1054 · Red Hat · Red Hat+4
Published
2004-12-31
·
Updated
2016-10-18
·
CVE-2004-1382
CVSS v2.0
2.1
Low
| Vector | AV:L/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.2.4 through 2.3.4
glibc-common version 2.2.4
glibc-profile version 2.2.4
glibc-devel version 2.2.4
Description
The issue concerns multiple vulnerabilities in the glibc package of Red Hat Enterprise Linux, which can be exploited locally to compromise the integrity of protected information. A specific vulnerability in glibc 2.3.4 and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Recommendations
For glibc versions 2.2.4 through 2.3.4, consider updating to a newer version to mitigate the risk.
For glibc-common version 2.2.4, restrict access to the vulnerable package to minimize the risk of exploitation.
For glibc-profile version 2.2.4, avoid using the vulnerable profile package until the issue is resolved.
For glibc-devel version 2.2.4, disable the development package temporarily to prevent potential exploitation.
As a temporary workaround, consider restricting the use of the
glibcbug script in glibc 2.3.4 and earlier versions until a patch is available.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Glibc
Glibc-Common
Glibc-Devel
Glibc-Profile