Multiple vulnerabilities in Glibc

1) Input validation error

EUVDB-ID: #VU41360

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2014-5119

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library (aka glibc) allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via vectors related to the CHARSET environment variable and gconv transliteration modules.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 2.0 - 2.1.97

CPE2.3

External links

https://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html
https://linux.oracle.com/errata/ELSA-2015-0092.html
https://lists.opensuse.org/opensuse-security-announce/2014-09/msg00017.html
https://rhn.redhat.com/errata/RHSA-2014-1118.html
https://seclists.org/fulldisclosure/2014/Aug/69
https://secunia.com/advisories/60345
https://secunia.com/advisories/60358
https://secunia.com/advisories/60441
https://secunia.com/advisories/61074
https://secunia.com/advisories/61093
https://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-5119
https://www.debian.org/security/2014/dsa-3012
https://www.mandriva.com/security/advisories?name=MDVSA-2014:175
https://www.openwall.com/lists/oss-security/2014/07/14/1
https://www.openwall.com/lists/oss-security/2014/08/13/5
https://www.securityfocus.com/bid/68983
https://www.securityfocus.com/bid/69738
https://www-01.ibm.com/support/docview.wss?uid=swg21685604
https://code.google.com/p/google-security-research/issues/detail?id=96
https://rhn.redhat.com/errata/RHSA-2014-1110.html
https://security.gentoo.org/glsa/201602-02
https://sourceware.org/bugzilla/show_bug.cgi?id=17187

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Unchecked Return Value

EUVDB-ID: #VU110092

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-1999-0199

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 0.1 - 2.1.97

CPE2.3

External links

https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz
https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40
https://www.cee.studio/tdelete.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Unchecked Return Value

EUVDB-ID: #VU110094

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-1999-0199

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

manual/search.texi in the GNU C Library (aka glibc) before 2.2 lacks a statement about the unspecified tdelete return value upon deletion of a tree's root, which might allow attackers to access a dangling pointer in an application whose developer was unaware of a documentation update from 1999.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Glibc: 0.1 - 2.1.97

CPE2.3

External links

https://ftp.gnu.org/gnu/glibc/glibc-2.2.tar.gz
https://github.com/bminor/glibc/commit/2864e767053317538feafa815046fff89e5a16be#diff-94e8c502f255fdfc346df0e29fd4ef40
https://www.cee.studio/tdelete.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2014-5119 CVE-1999-0199
CWE-ID	CWE-20 CWE-252
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Glibc Universal components / Libraries / Libraries used by multiple products
Vendor	GNU