PT-2013-1307 · Gnu+4 · Glibc+4

Will Newton · Published 2013-10-08 · Updated 2024-06-15 · CVE-2013-4332

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions glibc versions 2.18 and earlier

Description The issue is caused by multiple integer overflows in the malloc/malloc.c file of the GNU C Library, which allows context-dependent attackers to cause a denial of service, resulting in heap corruption. This can be achieved by providing a large value to the pvalloc, valloc, posix memalign, memalign, or aligned alloc functions.

Recommendations For glibc versions 2.18 and earlier, consider disabling the use of the pvalloc, valloc, posix memalign, memalign, and aligned alloc functions until a patch is available. Restrict access to these functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2014-1035

ALT-PU-2015-2084

BDU:2016-02235

BDU:2016-02236

CESA-2013_1605

CVE-2013-4332

DLA-165-1

MGASA-2013-0340

OPENSUSE-SU-2024:10154-1

RHSA-2013:1411

RHSA-2013:1605

RHSA-2013_1411

RHSA-2013_1605

SUSE-RU-2015:0794-1

SUSE-SU-2015:0253-1

SUSE-SU-2015:0439-1

SUSE-SU-2015:0551-1

Affected Products

Alt Linux

Centos

Red Hat

Suse

Glibc

References · 237

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb · Exploit
• 🔥 https://github.com/aaronfay/CVE-2015-0235-test · Exploit
• 🔥 https://github.com/makelinux/CVE-2015-0235-workaround · Exploit
• 🔥 https://github.com/arm13/ghost_exploit · Exploit
• 🔥 https://github.com/geekben/cve-collections/blob/master/cve20150235poc.c · Exploit
• 🔥 https://github.com/mikesplain/CVE-2015-0235-cookbook · Exploit
• 🔥 https://github.com/mholzinger/CVE-2015-0235_GHOST · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=15855 · Exploit
• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=15857 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2207 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-2084 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09813 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8984 · Security Note
• http://openwall.com/lists/oss-security/2013/09/12/6 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0475 · Security Note