Bug 108572

Summary: CAN-2003-0859 Netlink local DoS: glibc
Product: Red Hat Enterprise Linux 3 Reporter: Mark J. Cox (Product Security) <mjc>
Component: glibcAssignee: Jakub Jelinek <jakub>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 3.0Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-06-18 09:02:09 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Description Mark J. Cox (Product Security) 2003-10-30 05:23:51 EST
Herbert Xu discovered that a number of netlink applications do not
check the source address of incoming packets, assuming they are coming
from the kernel.  As any local user can send unicast netlink messages
to any process on the system, this can lead to a local denial of
service attack, or other local attacks.

glibc in RHEL3 is affected (getifaddrs)

Currently embargoed.
Comment 1 Mark J. Cox (Product Security) 2003-11-24 11:31:46 EST
was fixed by RHSA-2003:334
Comment 2 Josh Bressers 2004-06-18 09:02:09 EDT
I'm closing this since it's been fixed.