glibc: getgrouplist buffer overflow vulnerability — GLSA 200311-06

glibc contains a buffer overflow in the getgrouplist function.

Affected packages

Package	sys-libs/glibc on all architectures
Affected versions	<= 2.2.4
Unaffected versions	>= 2.2.5

Background

glibc is the GNU C library.

Description

A bug in the getgrouplist function can cause a buffer overflow if the size of the group list is too small to hold all the user's groups. This overflow can cause segmentation faults in user applications. This vulnerability exists only when an administrator has placed a user in a number of groups larger than that expected by an application.

Impact

Applications that use getgrouplist can crash.

Workaround

There is no known workaround at this time.

Resolution

It is recommended that all Gentoo Linux users update their systems as follows:

 # emerge sync
 # emerge -pv '>=sys-libs/glibc-2.2.5'
 # emerge '>=sys-libs/glibc-2.2.5'
 # emerge clean

References

CAN-2003-0689

Release date
November 22, 2003

Latest revision
November 22, 2003: 01

Severity
normal

Exploitable
local

Bugzilla entries

33383