Re: Is there a fix for the glob() and glibc vulnerability ?

[Andreas Jaeger]

"Stephane Rozes" <address@hidden> writes:

> I work for Cert-IST, a french CERT which is a member of FIRST
> (http://www.first.org).
>
> Recent posts on Bugtraq mailing-list publically disclosed a security bug in
> "glibc" (titled "[Global InterSec 2001121001] glibc globbing issues.") - see
> the attached e-mail.
>
> Yesterday, Red Hat released the security advisory "[RHSA-2001:160-09]
> Updated glibc packages are available" about that problem.
>
> We are not aware of any fix for that problem released by Glibc maintainer.
> Is there a new version of "glibc" that fixes that bug ?

glibc 2.2.5 will have this bug fixed, but it's not released yet and
there's no confirmed date yet.  I can send you the patch that will be
in glibc 2.2.5 if you like,

Andreas
-- 
 Andreas Jaeger
  SuSE Labs address@hidden
   private address@hidden
    http://www.suse.de/~aj