PT-2019-6470 · Gnu+1 · Gcc+1

Publicado 2014-03-15 · Atualizado 2019-10-31 · CVE-2002-2439

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions gcc versions prior to 4.8.0

Description The issue is related to an integer overflow in the new[] operator, which can lead to heap overflows and security bugs. When a new array is allocated, the C++ run-time calculates its size, but if the product exceeds the maximum value that can be stored in a machine register, the error is ignored, and the truncated value is used for the heap allocation.

Recommendations For gcc versions prior to 4.8.0, update to version 4.8.0 or later to resolve the issue. As a temporary workaround, consider implementing additional checks to prevent integer overflows when using the new[] operator. Restrict access to sensitive data and functions that utilize the new[] operator to minimize the risk of exploitation.

Exploit

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2014-1297

CVE-2002-2439

Produtos afetados

Alt Linux

Gcc

Referências · 12

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2002-2439 · Exploit
• 🔥 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=19351 · Exploit
• https://ubuntu.com/security/CVE-2002-2439 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2002-2439 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2002-2439 · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2014-1297 · Aviso do Fabricante
• https://t.me/cibsecurity/7619 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2002-2439 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-2439 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2002-2439 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2002-2439 · Nota