Multiple vulnerabilities in GNU Glibc

1) Configuration

EUVDB-ID: #VU45136

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1089

CWE-ID: CWE-16 - Configuration

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 1.00 - 2.12.2

CPE2.3

External links

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU45142

Risk: Medium

CVSSv3.1: 4.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1658

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

ld.so in the GNU C Library (aka glibc or libc6) 2.13 and earlier expands the $ORIGIN dynamic string token when RPATH is composed entirely of this token, which might allow local users to gain privileges by creating a hard link in an arbitrary directory to a (1) setuid or (2) setgid program with this RPATH value, and then executing the program with a crafted value for the LD_PRELOAD environment variable, a different vulnerability than CVE-2010-3847 and CVE-2011-0536. NOTE: it is not expected that any standard operating-system distribution would ship an applicable setuid or setgid program.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 1.00 - 2.12.2

CPE2.3

External links

http://secunia.com/advisories/46397
http://sourceware.org/bugzilla/show_bug.cgi?id=12393
http://www.securityfocus.com/archive/1/520102/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
http://bugzilla.redhat.com/show_bug.cgi?id=667974
http://exchange.xforce.ibmcloud.com/vulnerabilities/66820

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU45143

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-1659

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 1.00 - 2.12.2

CPE2.3

External links

http://code.google.com/p/chromium/issues/detail?id=48733
http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html
http://secunia.com/advisories/44353
http://secunia.com/advisories/46397
http://sourceware.org/bugzilla/show_bug.cgi?id=12583
http://sourceware.org/git/?p=glibc.git;a=commit;h=8126d90480fa3e0c5c5cd0d02cb1c93174b45485
http://www.mandriva.com/security/advisories?name=MDVSA-2011:178
http://www.mandriva.com/security/advisories?name=MDVSA-2011:179
http://www.securityfocus.com/archive/1/520102/100/0/threaded
http://www.securitytracker.com/id?1025450
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
http://bugzilla.redhat.com/show_bug.cgi?id=681054
http://exchange.xforce.ibmcloud.com/vulnerabilities/66819

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU45457

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2010-4051

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 1.00 - 2.12.2

CPE2.3

External links

http://cxib.net/stuff/proftpd.gnu.c
http://seclists.org/fulldisclosure/2011/Jan/78
http://secunia.com/advisories/42547
http://securityreason.com/achievement_securityalert/93
http://securityreason.com/securityalert/8003
http://securitytracker.com/id?1024832
http://www.exploit-db.com/exploits/15935
http://www.kb.cert.org/vuls/id/912279
http://www.securityfocus.com/archive/1/515589/100/0/threaded
http://www.securityfocus.com/bid/45233
http://bugzilla.redhat.com/show_bug.cgi?id=645859

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Resource management error

EUVDB-ID: #VU45458

Risk: Medium

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2010-4052

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: Yes

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 1.00 - 2.12.2

CPE2.3

External links

http://cxib.net/stuff/proftpd.gnu.c
http://seclists.org/fulldisclosure/2011/Jan/78
http://secunia.com/advisories/42547
http://securityreason.com/achievement_securityalert/93
http://securityreason.com/securityalert/8003
http://securitytracker.com/id?1024832
http://www.exploit-db.com/exploits/15935
http://www.kb.cert.org/vuls/id/912279
http://www.securityfocus.com/archive/1/515589/100/0/threaded
http://www.securityfocus.com/bid/45233
http://bugzilla.redhat.com/show_bug.cgi?id=645859

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

Risk	Medium
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2011-1089 CVE-2011-1658 CVE-2011-1659 CVE-2010-4051 CVE-2010-4052
CWE-ID	CWE-16 CWE-264 CWE-20 CWE-399
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #4 is available. Public exploit code for vulnerability #5 is available.
Vulnerable software Subscribe	Glibc Universal components / Libraries / Libraries used by multiple products
Vendor	GNU