Bug 108572

Summary: CAN-2003-0859 Netlink local DoS: glibc
Product: Red Hat Enterprise Linux 3 Reporter: Mark J. Cox <mjc>
Component: glibcAssignee: Jakub Jelinek <jakub>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-06-18 13:02:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mark J. Cox 2003-10-30 10:23:51 UTC
Herbert Xu discovered that a number of netlink applications do not
check the source address of incoming packets, assuming they are coming
from the kernel.  As any local user can send unicast netlink messages
to any process on the system, this can lead to a local denial of
service attack, or other local attacks.

glibc in RHEL3 is affected (getifaddrs)

Currently embargoed.

Comment 1 Mark J. Cox 2003-11-24 16:31:46 UTC
was fixed by RHSA-2003:334

Comment 2 Josh Bressers 2004-06-18 13:02:09 UTC
I'm closing this since it's been fixed.