Описание
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
A stack overflow vulnerability was found in _nss_dns_getnetbyname_r. On systems with nsswitch configured to include "networks: dns" with a privileged or network-facing service that would attempt to resolve user-provided network names, an attacker could provide an excessively long network name, resulting in stack corruption and code execution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | compat-glibc | Will not fix | ||
| Red Hat Enterprise Linux 5 | glibc | Will not fix | ||
| Red Hat Enterprise Linux 6 | compat-glibc | Will not fix | ||
| Red Hat Enterprise Linux 6 | glibc | Will not fix | ||
| Red Hat Enterprise Linux 7 | compat-glibc | Affected | ||
| Red Hat Enterprise Linux 7 | glibc | Fixed | RHSA-2016:2573 | 03.11.2016 |
Показывать по
Дополнительная информация
Статус:
7 High
CVSS3
5.8 Medium
CVSS2
Связанные уязвимости
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
Stack-based buffer overflow in the nss_dns implementation of the getne ...
Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attackers to cause a denial of service (stack consumption and application crash) via a long name.
7 High
CVSS3
5.8 Medium
CVSS2