PT-2018-2608 · Red Hat+1 · Glusterfs+1

Published 2018-10-05 · Updated 2023-02-12 · CVE-2018-14661

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions glusterfs version 3.8.4

Description The issue is related to the usage of the snprintf function in the feature/locks translator of the glusterfs server, which is vulnerable to a format string attack. A remote, authenticated attacker could exploit this to cause a remote denial of service. The vulnerability is associated with the use of an uncontrolled format string, allowing a remote attacker to disrupt service.

Recommendations For glusterfs version 3.8.4, consider restricting access to the feature/locks translator until a patch is available. As a temporary workaround, limiting the use of the snprintf function in this context may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-20

CWE-134

Related Identifiers

AZL-38872

BDU:2019-01159

CVE-2018-14661

DLA-1565-1

DLA-2806-1

RHSA-2018:3431

RHSA-2018:3432

RHSA-2018:3470

USN-4770-1

Affected Products

Ubuntu

Glusterfs

References · 45

• https://ubuntu.com/security/CVE-2014-3619 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3431 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10904 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38872 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10926 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14654 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10923 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10930 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10929 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4770-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14661 · Security Note
• https://security.gentoo.org/glsa/201904-06 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14661 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1565-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3432 · Vendor Advisory