RHSA-2003:022 - Security Advisory

Topic

Updated glibc packages are available to fix a buffer overflow in the
resolver.

Description

The GNU C library package, glibc, contains standard libraries used by
multiple programs on the system.

A read buffer overflow vulnerability exists in the glibc resolver code in
versions of glibc up to and including 2.2.5. The vulnerability is triggered
by DNS packets larger than 1024 bytes and can cause applications to crash.

In addition to this, several non-security related bugs have been fixed,
the majority for the Itanium (IA64) platform.

All Red Hat Linux Advanced Server users are advised to upgrade to these
errata packages which contain a patch to correct this vulnerability.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is available via Red Hat Network. To use Red
Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Workstation 2 ia64

Fixes

• BZ - 63934 - A Process may hugup when multithread process is completed.
• BZ - 65816 - mcount profiling has apparent problem on IA64
• BZ - 66548 - Max threads limit on RedHat Linux
• BZ - 70463 - vfprintf does not properly handle wide strings with precision of 0
• BZ - 73694 - forkexec and resulting stack limit differences (pthread vs. no pthread)
• BZ - 74742 - SIGSTKSZ & MINSIGSTKSZ are *way* off
• BZ - 76245 - mcount profiling has apparent problem on IA64 (bugzilla #65816)
• BZ - 76591 - glibc bugfix for statically linked app failure
• BZ - 76952 - strncpy(d,s,n) fails when s paged out and n > 24

CVEs

• CVE-2002-1146

References

(none)