PT-2015-4008 · Gnu+5 · Glibc+5
Robin Hack
·
Publicado
2015-03-05
·
Atualizado
2024-06-15
·
CVE-2014-8121
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
glibc versions 2.21 and earlier
Description
The issue is related to the DB LOOKUP function in the Name Service Switch (NSS) of the GNU C Library, which does not properly check if a file is open. This allows remote attackers to cause a denial of service by triggering an infinite loop when performing a look-up on a database while iterating over it, causing the file pointer to be reset.
Recommendations
For glibc versions 2.21 and earlier, update to a version later than 2.21 to resolve the issue. As a temporary workaround, consider restricting access to the DB LOOKUP function in nss files/files-XXX.c to minimize the risk of exploitation.
Exploit
Correção
DoS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Glibc