Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1) - Nessus

Critical   Plugin ID: 106134

---

This page contains detailed information about the Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 106134
Name: Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1)
Filename: ubuntu_USN-3534-1.nasl
Vulnerability Published: 2017-10-20
This Plugin Published: 2018-01-18
Last Modification Time: 2019-09-18
Plugin Version: 3.8
Plugin Type: local
Plugin Family: Ubuntu Local Security Checks
Dependencies: ssh_get_info.nasl
Required KB Items [?]: Host/cpu, Host/Debian/dpkg-l, Host/Ubuntu, Host/Ubuntu/release

Vulnerability Information

---

Severity: Critical
Vulnerability Published: 2017-10-20
Patch Published: 2018-01-17
CVE [?]: CVE-2017-15670, CVE-2017-15804, CVE-2017-16997, CVE-2017-17426, CVE-2017-1000408, CVE-2017-1000409, CVE-2018-1000001
CPE [?]: cpe:/o:canonical:ubuntu_linux:14.04, cpe:/o:canonical:ubuntu_linux:16.04, cpe:/o:canonical:ubuntu_linux:17.10, p-cpe:/a:canonical:ubuntu_linux:libc6

Synopsis

The remote Ubuntu host is missing a security-related patch.

Description

It was discovered that the GNU C library did not properly handle all of the possible return values from the kernel getcwd(2) syscall. A local attacker could potentially exploit this to execute arbitrary code in setuid programs and gain administrative privileges. (CVE-2018-1000001)

A memory leak was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_HWCAP_MASK environment variable, in combination with CVE-2017-1000409 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000408)

A heap-based buffer overflow was discovered in the _dl_init_paths() function in the GNU C library dynamic loader. A local attacker could potentially exploit this with a specially crafted value in the LD_LIBRARY_PATH environment variable, in combination with CVE-2017-1000408 and another vulnerability on a system with hardlink protections disabled, in order to gain administrative privileges. (CVE-2017-1000409)

An off-by-one error leading to a heap-based buffer overflow was discovered in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

A heap-based buffer overflow was discovered during unescaping of user names with the ~ operator in the GNU C library glob() implementation. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code via a maliciously crafted pattern. (CVE-2017-15804)

It was discovered that the GNU C library dynamic loader mishandles RPATH and RUNPATH containing $ORIGIN for privileged (setuid or AT_SECURE) programs. A local attacker could potentially exploit this by providing a specially crafted library in the current working directory in order to gain administrative privileges. (CVE-2017-16997)

It was discovered that the GNU C library malloc() implementation could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, resulting in a heap-based overflow. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 17.10. (CVE-2017-17426).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Solution

Update the affected libc6 package.

Public Exploits

---

Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1) vulnerability:

1. Metasploit: exploit/linux/local/glibc_realpath_priv_esc
   [glibc "realpath()" Privilege Escalation]
2. Metasploit: exploit/linux/local/glibc_realpath_priv_esc
   [glibc 'realpath()' Privilege Escalation]
3. Exploit-DB: exploits/linux/local/43331.txt
   [EDB-43331: GNU C Library Dynamic Loader glibc ld.so - Memory Leak / Buffer Overflow]
4. Exploit-DB: exploits/linux/local/44889.rb
   [EDB-44889: glibc - 'realpath()' Privilege Escalation (Metasploit)]
5. GitHub: https://github.com/flyrev/security-scan-ci-presentation
   [CVE-2017-15670]
6. GitHub: https://github.com/docker-library/faq
   [CVE-2017-15804]
7. GitHub: https://github.com/flyrev/security-scan-ci-presentation
   [CVE-2017-15804]
8. GitHub: https://github.com/ericcalabretta/inspec_resource_hab_pkg_deps
   [CVE-2017-16997]
9. GitHub: https://github.com/flyrev/security-scan-ci-presentation
   [CVE-2017-16997]
10. GitHub: https://github.com/flyrev/security-scan-ci-presentation
    [CVE-2017-1000408]
11. GitHub: https://github.com/flyrev/security-scan-ci-presentation
    [CVE-2017-1000409]
12. GitHub: https://github.com/Al1ex/LinuxEelvation
    [CVE-2018-1000001]
13. GitHub: https://github.com/BaseMax/AwesomeCompiler
    [CVE-2018-1000001]
14. GitHub: https://github.com/De4dCr0w/Linux-kernel-EoP-exp
    [CVE-2018-1000001]
15. GitHub: https://github.com/R0B1NL1N/Linux-Kernal-Exploits-m-
    [CVE-2018-1000001]
16. GitHub: https://github.com/Snoopy-Sec/Localroot-ALL-CVE
    [CVE-2018-1000001]
17. GitHub: https://github.com/anoaghost/Localroot_Compile
    [CVE-2018-1000001]
18. GitHub: https://github.com/flyrev/security-scan-ci-presentation
    [CVE-2018-1000001]
19. GitHub: https://github.com/qiantu88/Linux--exp
    [CVE-2018-1000001]
20. GitHub: https://github.com/rakjong/LinuxElevation
    [CVE-2018-1000001]
21. GitHub: https://github.com/usernameid0/tools-for-CVE-2018-1000001
    [CVE-2018-1000001: Tools for get offsets and adding patch for support i386]
22. GitHub: https://github.com/Xiami2012/CVE-2017-16997-poc
    [CVE-2017-16997: A proof-of-concept for CVE-2017-16997]
23. GitHub: https://github.com/0x00-0x00/CVE-2018-1000001
    [CVE-2018-1000001: Glibc getcwd() local privilege escalation compiled binaries]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS V2 Vector [?]: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C

CVSS Base Score:	9.3 (High)
Impact Subscore:	10.0
Exploitability Subscore:	8.6
CVSS Temporal Score:	7.7 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	7.7 (High)

CVSS V3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CVSS Base Score:	9.8 (Critical)
Impact Subscore:	5.9
Exploitability Subscore:	3.9
CVSS Temporal Score:	9.1 (Critical)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	9.1 (Critical)

Go back to menu.

Plugin Source

---

This is the ubuntu_USN-3534-1.nasl nessus plugin source code. Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-3534-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(106134);
  script_version("3.8");
  script_cvs_date("Date: 2019/09/18 12:31:47");

  script_cve_id("CVE-2017-1000408", "CVE-2017-1000409", "CVE-2017-15670", "CVE-2017-15804", "CVE-2017-16997", "CVE-2017-17426", "CVE-2018-1000001");
  script_xref(name:"USN", value:"3534-1");

  script_name(english:"Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1)");
  script_summary(english:"Checks dpkg output for updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Ubuntu host is missing a security-related patch."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that the GNU C library did not properly handle all
of the possible return values from the kernel getcwd(2) syscall. A
local attacker could potentially exploit this to execute arbitrary
code in setuid programs and gain administrative privileges.
(CVE-2018-1000001)

A memory leak was discovered in the _dl_init_paths() function in the
GNU C library dynamic loader. A local attacker could potentially
exploit this with a specially crafted value in the LD_HWCAP_MASK
environment variable, in combination with CVE-2017-1000409 and another
vulnerability on a system with hardlink protections disabled, in order
to gain administrative privileges. (CVE-2017-1000408)

A heap-based buffer overflow was discovered in the _dl_init_paths()
function in the GNU C library dynamic loader. A local attacker could
potentially exploit this with a specially crafted value in the
LD_LIBRARY_PATH environment variable, in combination with
CVE-2017-1000408 and another vulnerability on a system with hardlink
protections disabled, in order to gain administrative privileges.
(CVE-2017-1000409)

An off-by-one error leading to a heap-based buffer overflow was
discovered in the GNU C library glob() implementation. An attacker
could potentially exploit this to cause a denial of service or execute
arbitrary code via a maliciously crafted pattern. (CVE-2017-15670)

A heap-based buffer overflow was discovered during unescaping of user
names with the ~ operator in the GNU C library glob() implementation.
An attacker could potentially exploit this to cause a denial of
service or execute arbitrary code via a maliciously crafted pattern.
(CVE-2017-15804)

It was discovered that the GNU C library dynamic loader mishandles
RPATH and RUNPATH containing $ORIGIN for privileged (setuid or
AT_SECURE) programs. A local attacker could potentially exploit this
by providing a specially crafted library in the current working
directory in order to gain administrative privileges. (CVE-2017-16997)

It was discovered that the GNU C library malloc() implementation could
return a memory block that is too small if an attempt is made to
allocate an object whose size is close to SIZE_MAX, resulting in a
heap-based overflow. An attacker could potentially exploit this to
cause a denial of service or execute arbitrary code. This issue only
affected Ubuntu 17.10. (CVE-2017-17426).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/3534-1/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected libc6 package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'glibc "realpath()" Privilege Escalation');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libc6");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:17.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/10/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/01/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/18");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(14\.04|16\.04|17\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 14.04 / 16.04 / 17.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"14.04", pkgname:"libc6", pkgver:"2.19-0ubuntu6.14")) flag++;
if (ubuntu_check(osver:"16.04", pkgname:"libc6", pkgver:"2.23-0ubuntu10")) flag++;
if (ubuntu_check(osver:"17.10", pkgname:"libc6", pkgver:"2.26-0ubuntu2.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libc6");
}

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/ubuntu_USN-3534-1.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\ubuntu_USN-3534-1.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/ubuntu_USN-3534-1.nasl

Go back to menu.

How to Run

---

Here is how to run the Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Ubuntu Local Security Checks plugin family.
6. On the right side table select Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : eglibc, glibc vulnerabilities (USN-3534-1) plugin ID 106134.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl ubuntu_USN-3534-1.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a ubuntu_USN-3534-1.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - ubuntu_USN-3534-1.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state ubuntu_USN-3534-1.nasl -t <IP/HOST>

Go back to menu.

References

---

USN | Ubuntu Security Notice:

• 3534-1

See also:

• https://www.tenable.com/plugins/nessus/106134
• https://usn.ubuntu.com/3534-1/
• https://vulners.com/nessus/UBUNTU_USN-3534-1.NASL

Similar and related Nessus plugins:

• 104292 - EulerOS 2.0 SP1 : glibc (EulerOS-SA-2017-1267)
• 104293 - EulerOS 2.0 SP2 : glibc (EulerOS-SA-2017-1268)
• 105814 - Fedora 27 : glibc (2017-0d3fdd3d1f)
• 105918 - Fedora 27 : glibc (2017-828f8a8fc6)
• 106014 - Fedora 27 : glibc (2017-fb5e227432)
• 106041 - SUSE SLES12 Security Update : glibc (SUSE-SU-2018:0071-1)
• 106044 - SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0074-1)
• 106045 - SUSE SLES11 Security Update : glibc (SUSE-SU-2018:0075-1)
• 106046 - SUSE SLES12 Security Update : glibc (SUSE-SU-2018:0076-1)
• 106059 - openSUSE Security Update : glibc (openSUSE-2018-30)
• 106279 - Fedora 27 : glibc (2018-7714b514e2)
• 106281 - Fedora 26 : glibc (2018-8e27ad96ed)
• 106775 - EulerOS 2.0 SP1 : glibc (EulerOS-SA-2018-1047)
• 106776 - EulerOS 2.0 SP2 : glibc (EulerOS-SA-2018-1048)
• 106865 - SUSE SLED12 / SLES12 Security Update : glibc (SUSE-SU-2018:0451-1)
• 106916 - openSUSE Security Update : glibc (openSUSE-2018-184)
• 107086 - SUSE SLES11 Security Update : glibc (SUSE-SU-2018:0565-1)
• 108822 - GLSA-201804-02 : glibc: Multiple vulnerabilities
• 108985 - RHEL 7 : glibc (RHSA-2018:0805)
• 109105 - Oracle Linux 7 : glibc (ELSA-2018-0805)
• 109371 - CentOS 7 : glibc (CESA-2018:0805)
• 109447 - Scientific Linux Security Update : glibc on SL7.x x86_64 (20180410)
• 109699 - Amazon Linux AMI : glibc (ALAS-2018-1017)
• 110603 - RHEL 6 : glibc (RHSA-2018:1879)
• 110648 - CentOS 6 : glibc (CESA-2018:1879)
• 110704 - Oracle Linux 6 : glibc (ELSA-2018-1879)
• 110884 - OracleVM 3.3 / 3.4 : glibc (OVMSA-2018-0235)

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file ubuntu_USN-3534-1.nasl version 3.8. For more plugins, visit the Nessus Plugin Library.

Go back to menu.