PT-2015-3583 · Gnu+5 · Glibc+5

Arnaud.Lb + 2 · Publicado 2015-02-24 · Atualizado 2024-06-15 · CVE-2013-7423

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions glibc versions prior to 2.20

Description The issue arises from the send dg function in resolv/res send.c, which fails to properly reuse file descriptors. This allows remote attackers to send DNS queries to unintended locations by triggering a large number of requests that call the getaddrinfo function.

Recommendations For versions prior to 2.20, update to version 2.20 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

ALT-PU-2015-2084

CESA-2015_0863

CESA-2015_2199

CVE-2013-7423

DLA-165-1

MGASA-2015-0195

OPENSUSE-SU-2024:10154-1

RHSA-2015:0863

RHSA-2015:2199

RHSA-2015:2589

RHSA-2015_0863

RHSA-2015_2199

RHSA-2016:1207

SUSE-RU-2015:0794-1

SUSE-SU-2015:0253-1

SUSE-SU-2015:0439-1

SUSE-SU-2015:0526-1

SUSE-SU-2015:0551-1

SUSE-SU-2015_0439-1

SUSE-SU-2015_0526-1

SUSE-SU-2015_0550-1

SUSE-SU-2015_0551-1

USN-2519-1

Produtos afetados

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Glibc

Referências · 83

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb · Exploit
• 🔥 https://github.com/aaronfay/CVE-2015-0235-test · Exploit
• 🔥 https://github.com/makelinux/CVE-2015-0235-workaround · Exploit
• 🔥 https://github.com/arm13/ghost_exploit · Exploit
• 🔥 https://github.com/geekben/cve-collections/blob/master/cve20150235poc.c · Exploit
• 🔥 https://github.com/mikesplain/CVE-2015-0235-cookbook · Exploit
• 🔥 https://github.com/mholzinger/CVE-2015-0235_GHOST · Exploit
• https://github.com/golang/go/issues/6336 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-7423 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7423 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-8778 · Nota
• https://suse.com/security/cve/CVE-2014-9402 · Nota
• https://suse.com/security/cve/CVE-2013-4237 · Nota
• https://osv.dev/vulnerability/CVE-2013-7423 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-8121 · Nota