SB2021090141 - Resource management error in Glibc

Description

This security bulletin contains information about 1 vulnerability.

1) Resource management error (CVE-ID: CVE-2010-4756)

CWE-ID: CWE-399 - Resource Management Errors

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to perform service disruption.

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

Remediation

Install update from vendor's website.

References

• http://securityreason.com/exploitalert/9223
• http://cxib.net/stuff/glob-0day.c
• http://securityreason.com/achievement_securityalert/89
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756
• https://bugzilla.redhat.com/show_bug.cgi?id=681681