Summary
The remote host is missing an update to glibc
announced via advisory DSA 039-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%20039-1
Insight
The version of GNU libc that was distributed with Debian GNU/Linux 2.2 suffered from 2 security problems:
* It was possible to use LD_PRELOAD to load libraries that are listed in /etc/ld.so.cache, even for suid programs. This could be used to create (and overwrite) files which a user should not be allowed to.
* by using LD_PROFILE suid programs would write data to a file to /var/tmp, which was not done safely. Again, this could be used to create (and overwrite) files which a user should not have access to.
Both problems have been fixed in version 2.1.3-17 and we recommend that you upgrade your glibc packages immediately.
Please note that a side-effect of this upgrade is that ldd will no longer work on suid programs, unless you logged in as root.
Severity
Classification
-
CVE CVE-2001-0169 -
CVSS Base Score: 2.1
AV:L/AC:L/Au:N/C:N/I:P/A:N
Related Vulnerabilities