PT-2011-1211 · Gnu+1 · Gnu C Library+1
Maksymilian Arciemowicz
·
Published
2011-01-13
·
Updated
2021-06-18
·
CVE-2010-4051
CVSS v2.0
5.0
Medium
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Name of the Vulnerable Software and Affected Versions
GNU C Library (glibc or libc6) versions 2.11.3 and earlier, 2.12.x through 2.12.2
Description
The issue is related to the regcomp implementation, which allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE DUP MAX limitation. This can be exploited by using regular expressions with specific sequences, such as
{10,}{10,}{10,}{10,}{10,}, to cause an application crash. The vulnerability is associated with errors in resource management and code errors, allowing a remote attacker to cause a denial of service (resource exhaustion) using regular expressions with repetition operators.Recommendations
For GNU C Library (glibc or libc6) versions 2.11.3 and earlier, update to a version later than 2.11.3 to resolve the issue.
For GNU C Library (glibc or libc6) versions 2.12.x through 2.12.2, update to a version later than 2.12.2 to resolve the issue.
As a temporary workaround, consider restricting the use of regular expressions with repetition operators to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Gnu C Library
Junos