PT-2014-1818 · Gnu+4 · Glibc+4
Publicado
2014-11-24
·
Atualizado
2024-06-15
·
CVE-2014-7817
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.12
glibc-common versions 2.12
glibc-devel versions 2.12
glibc-debuginfo versions 2.12
glibc-debuginfo-common versions 2.12
glibc-headers versions 2.12
glibc-static versions 2.12
glibc-utils versions 2.12
Description
The issue concerns multiple vulnerabilities in the glibc package, which can lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The wordexp function in GNU C Library (aka glibc) does not enforce the WRDE NOCMD flag, allowing context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((
...))".Recommendations
For glibc versions 2.12, update to a newer version to mitigate the risk.
For glibc-common versions 2.12, update to a newer version to mitigate the risk.
For glibc-devel versions 2.12, update to a newer version to mitigate the risk.
For glibc-debuginfo versions 2.12, update to a newer version to mitigate the risk.
For glibc-debuginfo-common versions 2.12, update to a newer version to mitigate the risk.
For glibc-headers versions 2.12, update to a newer version to mitigate the risk.
For glibc-static versions 2.12, update to a newer version to mitigate the risk.
For glibc-utils versions 2.12, update to a newer version to mitigate the risk.
As a temporary workaround, consider restricting access to the wordexp function until a patch is available.
Exploit
Correção
Buffer Overflow
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Suse
Ubuntu
Glibc