PT-2013-1305 · Gnu+2 · Glibc+3

Hector Marco · Published 2013-10-04 · Updated 2017-07-01 · CVE-2013-4788

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions glibc versions 2.4 through 2.17 eglibc versions 2.4 through 2.17

Description The issue is related to the PTR MANGLE implementation in glibc and eglibc, which does not properly initialize a random value for pointer protection. This can be exploited by a remote attacker to control execution flow by using a buffer overflow in an application and the known zero value of the pointer guard to calculate a pointer address in memory.

Recommendations For glibc versions 2.4 through 2.17, update to a version that properly initializes the random value for the pointer guard. For eglibc versions 2.4 through 2.17, update to a version that properly initializes the random value for the pointer guard. As a temporary workaround, consider restricting the use of applications that utilize the PTR MANGLE implementation until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-1035

ALT-PU-2015-2084

BDU:2016-02233

CVE-2013-4788

DLA-165-1

MGASA-2013-0340

SUSE-RU-2015:0794-1

SUSE-SU-2015:0253-1

SUSE-SU-2015:0439-1

SUSE-SU-2015:0551-1

Affected Products

Alt Linux

Suse

Eglibc

Glibc

References · 191

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb · Exploit
• 🔥 https://github.com/aaronfay/CVE-2015-0235-test · Exploit
• 🔥 https://github.com/makelinux/CVE-2015-0235-workaround · Exploit
• 🔥 https://github.com/arm13/ghost_exploit · Exploit
• 🔥 https://github.com/geekben/cve-collections/blob/master/cve20150235poc.c · Exploit
• 🔥 https://github.com/mikesplain/CVE-2015-0235-cookbook · Exploit
• 🔥 https://github.com/mholzinger/CVE-2015-0235_GHOST · Exploit
• 🔥 http://hmarco.org/bugs/CVE-2013-4788.html · Exploit
• 🔥 https://exploit-db.com/exploits/28657 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/07/15/9 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2207 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-2084 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09813 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8984 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1035 · Vendor Advisory