PT-2015-4008 · Gnu+5 · Glibc+5

Robin Hack · Published 2015-03-05 · Updated 2024-06-15 · CVE-2014-8121

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions glibc versions 2.21 and earlier

Description The issue is related to the DB LOOKUP function in the Name Service Switch (NSS) of the GNU C Library, which does not properly check if a file is open. This allows remote attackers to cause a denial of service by triggering an infinite loop when performing a look-up on a database while iterating over it, causing the file pointer to be reset.

Recommendations For glibc versions 2.21 and earlier, update to a version later than 2.21 to resolve the issue. As a temporary workaround, consider restricting access to the DB LOOKUP function in nss files/files-XXX.c to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-17

Related Identifiers

ALT-PU-2015-2084

CESA-2015_0327

CVE-2014-8121

DLA-316-1

DSA-3480-1

MGASA-2015-0195

OPENSUSE-SU-2024:10154-1

RHSA-2015:0327

RHSA-2015_0327

SUSE-SU-2015:1424-1

SUSE-SU-2015:1844-1

SUSE-SU-2015_1844-1

SUSE-SU-2016:0470-1

USN-2985-1

USN-2985-2

Affected Products

Alt Linux

Centos

Red Hat

Suse

Ubuntu

Glibc

References · 304

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/smtp/exim_gethostbyname_bof.rb · Exploit
• 🔥 https://github.com/fjserna/CVE-2015-7547 · Exploit
• 🔥 https://github.com/aaronfay/CVE-2015-0235-test · Exploit
• 🔥 https://github.com/eSentire/cve-2015-7547-public · Exploit
• 🔥 https://github.com/jgajek/cve-2015-7547 · Exploit
• 🔥 https://github.com/makelinux/CVE-2015-0235-workaround · Exploit
• 🔥 https://github.com/cakuzo/CVE-2015-7547 · Exploit
• 🔥 https://github.com/arm13/ghost_exploit · Exploit
• 🔥 https://github.com/geekben/cve-collections/blob/master/cve20150235poc.c · Exploit
• 🔥 https://github.com/mikesplain/CVE-2015-0235-cookbook · Exploit
• 🔥 https://github.com/mholzinger/CVE-2015-0235_GHOST · Exploit
• 🔥 https://sourceware.org/ml/libc-alpha/2015-02/msg00617.html · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1165192 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2207 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.html · Vendor Advisory