glibc: getgrouplist buffer overflow vulnerability
Gentoo Linux Security Advisory
||GLSA 200311-06 / glibc
||November 22, 2003
||November 22, 2003: 01
All supported architectures
glibc contains a buffer overflow in the getgrouplist function.
glibc is the GNU C library.
A bug in the getgrouplist function can cause a buffer overflow if the size
of the group list is too small to hold all the user's groups. This overflow
can cause segmentation faults in user applications. This vulnerability
exists only when an administrator has placed a user in a number of groups
larger than that expected by an application.
Applications that use getgrouplist can crash.
There is no known workaround at this time.
It is recommended that all Gentoo Linux users update their systems as
Code Listing 3.1: Resolution
# emerge sync
# emerge -pv '>=sys-libs/glibc-2.2.5'
# emerge '>=sys-libs/glibc-2.2.5'
# emerge clean