Memory corruption in GNU C Library (glibc) - CVE-2017-15670

Vulnerability identifier: #VU11544

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15670

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code with elevated privileges on the target system.

The weakness exists in the glob function in glob.c due to off-by-one error. A remote attacker can trigger heap-based buffer overflow and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

GNU C Library (glibc)
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
SUSE Linux
Fedora
Opensuse
Red Hat Virtualization Host
Dynamic System Analysis (DSA) Preboot
Flex System Chassis Management Module (CMM)
glibc
Dell EMC Unisphere Central

Update to version 2.27.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
Flex System Chassis Management Module (CMM) - update to 2pet18a-2.5.14a
glibc - addressed in versions 2.25-13.fc26, 2.26-15.fc27
Dell EMC Unisphere Central - update to 4.0.8.23220

• https://sourceware.org/bugzilla/show_bug.cgi?id=22320

• Arch Linux update for glibc
• Arch Linux update for lib32-glibc
• Gentoo update for glibc
• Amazon Linux AMI update for glibc
• Red Hat update for glibc
• Red Hat update for glibc
• OpenSUSE Linux update for glibc
• SUSE Linux update for glibc
• Multiple vulnerabilities in Dell EMC Unisphere Central
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 27 update for glibc
• Fedora 26 update for glibc