PT-2012-1186 · Gnu+3 · Gnu C Library+3

Jan Lieskovsky · Published 2012-08-25 · Updated 2023-02-13 · CVE-2012-3480

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU C Library (aka glibc or libc6) version 2.16

Description The issue is caused by multiple integer overflows in various functions, including strtod, strtof, strtold, and strtod l, within the stdlib component of the GNU C Library. This can lead to a denial of service, resulting in an application crash, and potentially allow the execution of arbitrary code. The exploitation occurs when a long string is used, triggering a stack-based buffer overflow.

Recommendations For GNU C Library (aka glibc or libc6) version 2.16, consider updating to a newer version that addresses the integer overflows in the affected functions. As a temporary workaround, restrict the use of the strtod, strtof, strtold, and strtod l functions to minimize the risk of exploitation. Avoid using long strings that could trigger the stack-based buffer overflow in these functions.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2016-01582

CESA-2012_1208

CVE-2012-3480

DLA-165-1

RHSA-2012:1207

RHSA-2012:1208

RHSA-2012:1325

RHSA-2012_1207

RHSA-2012_1208

SUSE-SU-2012_1667-1

SUSE-SU-2015:0551-1

Affected Products

Centos

Gnu C Library

Red Hat

Suse

References · 39

• 🔥 https://exploit-db.com/exploits/37631 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3480 · Security Note
• https://linux.oracle.com/errata/ELSA-2012-1208.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1208.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1262.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1207.html · Vendor Advisory
• https://security.gentoo.org/glsa/201503-04 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3480 · Vendor Advisory
• http://ubuntu.com/usn/USN-1589-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1325.html · Vendor Advisory
• http://secunia.com/advisories/50201 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085190.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3480 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01582 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-3480 · Security Note