SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   GNU Project Debugger (GDB) Vendors:   GNU [multiple authors]
(Red Hat Issues Fix for GDB) Apple Xcode GDB DWARF Binary Bug Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1017988
SecurityTracker URL:  http://securitytracker.com/id/1017988
CVE Reference:   CVE-2006-4146   (Links to External Site)
Date:  May 1 2007
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Apple Xcode. A remote user can cause arbitrary code to be executed on the target user's system. The GNU Debugger (gdb) is affected.

A remote user can create a specially crafted DWARF binary file that, when loaded by the target user with the GNU Debugger (GDB) component of Xcode, will execute arbitrary code on the target system. The code will run with the privileges of the target user.

Apple credits Will Drewry and Tavis Ormandy of the Google Security Team with reporting this vulnerability.
Impact:   A remote user can create a DWARF binary file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   Red Hat has released a fix for GDB.

The Red Hat advisory is available at:

https://rhn.redhat.com/errata/RHSA-2007-0229.html
Cause:   Not specified
Underlying OS:   Linux (Red Hat Enterprise)

Message History:   This archive entry is a follow-up to the message listed below.
Nov 1 2006 Apple Xcode GDB DWARF Binary Bug Lets Remote Users Execute Arbitrary Code


 Source Message Contents
Date:  Tue, 1 May 2007 13:51:41 -0400
Subject:  [RHSA-2007:0229-02] Low: gdb security and bug fix update


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Low: gdb security and bug fix update
Advisory ID:       RHSA-2007:0229-02
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0229.html
Issue date:        2007-05-01
Updated on:        2007-05-01
Product:           Red Hat Enterprise Linux
Keywords:          stack buffer overflow dwarf
CVE Names:         CVE-2006-4146 
- ---------------------------------------------------------------------

1. Summary:

An updated gdb package that fixes a security issue and various bugs is now
available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

GDB, the GNU debugger, allows debugging of programs written in C, C++, and
other languages by executing them in a controlled fashion and then printing
their data.

Various buffer overflows and underflows were found in the DWARF expression
computation stack in GDB. If a user loaded an executable containing
malicious debugging information into GDB, an attacker might be able to
execute arbitrary code with the privileges of the user. (CVE-2006-4146)

This updated package also addresses the following issues:

* Fixed bogus 0x0 unwind of the thread's topmost function clone(3).

* Fixed deadlock accessing invalid address; for corrupted backtraces.

* Fixed a race which occasionally left the detached processes stopped.

* Fixed 'gcore' command for 32bit debugged processes on 64bit hosts.

* Added support for TLS 'errno' for threaded programs missing its '-debuginfo' package..

* Suggest TLS 'errno' resolving by hand if no threading was found..

* Added a fix to prevent stepping into asynchronously invoked signal handlers.

* Added a fix to avoid false warning on shared objects bfd close on Itanium.

* Fixed segmentation fault on the source display by ^X 1.

* Fixed object names keyboard completion.

* Added a fix to avoid crash of 'info threads' if stale threads exist.

* Fixed a bug where shared libraries occasionally failed to load .

* Fixed handling of exec() called by a threaded debugged program.

* Fixed rebuilding requirements of the gdb package itself on multilib systems.

* Fixed source directory pathname detection for the edit command.

All users of gdb should upgrade to this updated package, which contains
backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

185337 - p errno does not work when stopped at a breakpoint
193763 - Buffer overrun in add_minsym_members
195429 - info threads crashes if zombie threads exist
202682 - print call foo where foo is in library SEGV
202689 - Cannot find user-level thread for LWP 4256: generic error
204841 - CVE-2006-4146 GDB buffer overflow

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/gdb-6.3.0.0-1.143.el4.src.rpm
ed563ce21a2006efbc0692d66be0bc53  gdb-6.3.0.0-1.143.el4.src.rpm

i386:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm

ia64:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
529d36635ac1f649794a221566f2338f  gdb-6.3.0.0-1.143.el4.ia64.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm
ce560ff1d05b9de73627f650d561b831  gdb-debuginfo-6.3.0.0-1.143.el4.ia64.rpm

ppc:
98566f98be211ce100067cd7b85d3509  gdb-6.3.0.0-1.143.el4.ppc64.rpm
5d5dc74b03dc8832476add8b850a09ed  gdb-debuginfo-6.3.0.0-1.143.el4.ppc64.rpm

s390:
bc1203b4bff149f6c2ca5b69e534060b  gdb-6.3.0.0-1.143.el4.s390.rpm
e5e6b66defffe1f28c471d5bd877072a  gdb-debuginfo-6.3.0.0-1.143.el4.s390.rpm

s390x:
bf0e6243efc9bbe4b99c112bb018f1b3  gdb-6.3.0.0-1.143.el4.s390x.rpm
0019f56e10a21f8a97042fb32144c86a  gdb-debuginfo-6.3.0.0-1.143.el4.s390x.rpm

x86_64:
1226da2eef9141ecb6c1a6f8cdd985ab  gdb-6.3.0.0-1.143.el4.x86_64.rpm
665fc3e159ab7f043580b89af8900042  gdb-debuginfo-6.3.0.0-1.143.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/gdb-6.3.0.0-1.143.el4.src.rpm
ed563ce21a2006efbc0692d66be0bc53  gdb-6.3.0.0-1.143.el4.src.rpm

i386:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm

x86_64:
1226da2eef9141ecb6c1a6f8cdd985ab  gdb-6.3.0.0-1.143.el4.x86_64.rpm
665fc3e159ab7f043580b89af8900042  gdb-debuginfo-6.3.0.0-1.143.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/gdb-6.3.0.0-1.143.el4.src.rpm
ed563ce21a2006efbc0692d66be0bc53  gdb-6.3.0.0-1.143.el4.src.rpm

i386:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm

ia64:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
529d36635ac1f649794a221566f2338f  gdb-6.3.0.0-1.143.el4.ia64.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm
ce560ff1d05b9de73627f650d561b831  gdb-debuginfo-6.3.0.0-1.143.el4.ia64.rpm

x86_64:
1226da2eef9141ecb6c1a6f8cdd985ab  gdb-6.3.0.0-1.143.el4.x86_64.rpm
665fc3e159ab7f043580b89af8900042  gdb-debuginfo-6.3.0.0-1.143.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/gdb-6.3.0.0-1.143.el4.src.rpm
ed563ce21a2006efbc0692d66be0bc53  gdb-6.3.0.0-1.143.el4.src.rpm

i386:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm

ia64:
9b62527f67a18e666b0b067bcdd41c80  gdb-6.3.0.0-1.143.el4.i386.rpm
529d36635ac1f649794a221566f2338f  gdb-6.3.0.0-1.143.el4.ia64.rpm
bbe7e50dad259353505bcd74e7ea94d8  gdb-debuginfo-6.3.0.0-1.143.el4.i386.rpm
ce560ff1d05b9de73627f650d561b831  gdb-debuginfo-6.3.0.0-1.143.el4.ia64.rpm

x86_64:
1226da2eef9141ecb6c1a6f8cdd985ab  gdb-6.3.0.0-1.143.el4.x86_64.rpm
665fc3e159ab7f043580b89af8900042  gdb-debuginfo-6.3.0.0-1.143.el4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4146
http://www.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFGN34rXlSAg2UNWIIRAmb/AKDBHa0hjTKFqO+RxhRMzqXGae+xKgCgr9v5
Z8jHlpIxzEvLRaqmbKJeT3k=
=TNz5
-----END PGP SIGNATURE-----



-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2012, SecurityGlobal.net LLC