PT-2014-2127 · Gnu · Eglibc+1

CVE-2011-2702 · Publicado 2014-10-27 · Atualizado 2023-02-13

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Glibc versions prior to 2.13 eglibc versions prior to 2.13

Description The issue is related to an integer signedness error when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization. This error allows context-dependent attackers to execute arbitrary code via a negative length parameter to certain functions, which triggers an out-of-bounds read. The affected functions include memcpy-ssse3-rep.S, memcpy-ssse3.S, and memset-sse2.S in sysdeps/i386/i686/multiarch/.

Recommendations For Glibc versions prior to 2.13, update to version 2.13 or later. For eglibc versions prior to 2.13, update to version 2.13 or later.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2011-2702

Produtos afetados

Glibc

Eglibc

Referências · 10

• 🔥 http://xorl.wordpress.com/2011/08/06/cve-2011-2702-eglibc-and-glibc-signedness-issue · Exploit
• 🔥 https://exploit-db.com/exploits/20167 · Exploit
• https://bugzilla.novell.com/show_bug.cgi?id=706915 · Nota
• http://seclists.org/oss-sec/2011/q3/153 · Nota
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=a0ac24d98ace90d1ccba6a2f3e7d55600f2fdb6e · Nota
• http://seclists.org/oss-sec/2011/q3/123 · Nota
• http://nodefense.org/eglibc.txt · Nota
• http://osvdb.org/80718 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-2702 · Nota de Segurança
• http://eglibc.org/cgi-bin/viewvc.cgi/trunk/libc/ChangeLog?view=markup&pathrev=10032 · Nota