Buffer overflow in GNU C Library (glibc) - CVE-2017-15804

Vulnerability identifier: #VU11546

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15804

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the glob function in glob.c due to buffer overflow during unescaping of user names with the ~ operator. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

GNU C Library (glibc)
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
SUSE Linux
Fedora
Opensuse
Red Hat Virtualization Host
Dynamic System Analysis (DSA) Preboot
Integrated Management Module II (IMM2) for BladeCenter Systems
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
glibc
Dell EMC Unisphere Central

Update to version 2.27.

Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
System x Integrated Management Module (IMM2) - update to 1AOO88B-7.20
Flex System Integrated Management Module (IMM2) - update to 1AOO88B-7.20
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO88B-7.20-bc
Flex System Chassis Management Module (CMM) - update to 2pet18a-2.5.14a
glibc - addressed in versions 2.25-13.fc26, 2.26-20.fc27
Dell EMC Unisphere Central - update to 4.0.8.23220

• https://sourceware.org/bugzilla/show_bug.cgi?id=22332

• Gentoo update for glibc
• Amazon Linux AMI update for glibc
• Red Hat update for glibc
• Red Hat update for glibc
• OpenSUSE Linux update for glibc
• SUSE Linux update for glibc
• Multiple vulnerabilities in Dell EMC Unisphere Central
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• IBM Integrated Management Module II (IMM2) update for GNU C Library
• Fedora 27 update for glibc
• Fedora 26 update for glibc