Use-after-free error in GNU C Library (glibc) - CVE-2017-12133

Vulnerability identifier: #VU11787

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12133

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the DNS stub resolver due to it will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attackers due to IP fragmentation when enabling EDNS support. A remote attacker can trigger use after free and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

GNU C Library (glibc)
Ubuntu
Fedora
System x Integrated Management Module (IMM2)
Flex System Integrated Management Module (IMM2)
Flex System Chassis Management Module (CMM)
Integrated Management Module II (IMM2) for BladeCenter Systems
libc6 (Ubuntu package)
glibc
Dell EMC Unisphere Central

Update to version 2.26.

System x Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Flex System Integrated Management Module (IMM2) - update to 1AOO84C-6.80
Integrated Management Module II (IMM2) for BladeCenter Systems - update to 1AOO84C-6.80-bc
Flex System Chassis Management Module (CMM) - update to 2pet16c-2.5.12c
libc6 (Ubuntu package) - addressed in versions 2.23-0ubuntu11.2, 2.27-3ubuntu1.2, 2.30-0ubuntu2.2
glibc - update to 2.24-10.fc25
Dell EMC Unisphere Central - update to 4.0.8.23220

• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d42eed4a044e5e10dfb885cf9891c2518a72a491

• Remote code execution in GNU Glibc
• Multiple vulnerabilities in Dell EMC Unisphere Central
• IBM Integrated Management Module II (IMM2) update for GNU C Library
• IBM Flex System Chassis Management Module (CMM) update for GNU C Library
• Ubuntu update for glibc
• Fedora 25 update for glibc