Input validation error in GNU C Library (glibc) - CVE-2016-10739

Vulnerability identifier: #VU17105

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-10739

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to the getaddrinfo() function accepts an IPv4 address followed by whitespace and arbitrary characters and treats his input as a correct IPv4 address. Software that accepts input from the getaddrinfo() function may incorrectly assume that the function return IPv4 address only. As a result, a remote attacker can inject arbitrary data into the IPv4 address and change application's behavior that relies on getaddrinfo() output (e.g., inject HTTP headers or other potentially dangerous strings).

GNU C Library (glibc)
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
Opensuse
Red Hat Virtualization Host
BIG-IP
Netcool Operations Insight
IBM Cloud Transformation Advisor
glibc-32bit
glibc-info
glibc-i18ndata
glibc-html
nscd-debuginfo
nscd
glibc-profile-32bit
glibc-profile
glibc-locale-debuginfo-32bit
glibc-locale-debuginfo
glibc-locale-32bit
glibc-locale
glibc-devel-debuginfo-32bit
glibc-devel-debuginfo
glibc-devel-32bit
glibc-devel
glibc-debugsource
glibc-debuginfo-32bit
glibc-debuginfo
glibc
Robotic Process Automation for Cloud Pak

Install updates from vendor's repository. This vulnerability will be fixed in the upcoming glibc release 2.29.

Netcool Operations Insight - update to 1.6.8
glibc-32bit - update to 2.22-133.1
glibc-info - update to 2.22-133.1
glibc-i18ndata - update to 2.22-133.1
glibc-html - update to 2.22-133.1
nscd-debuginfo - update to 2.22-133.1
nscd - update to 2.22-133.1
glibc-profile-32bit - update to 2.22-133.1
glibc-profile - update to 2.22-133.1
glibc-locale-debuginfo-32bit - update to 2.22-133.1
glibc-locale-debuginfo - update to 2.22-133.1
glibc-locale-32bit - update to 2.22-133.1
glibc-locale - update to 2.22-133.1
glibc-devel-debuginfo-32bit - update to 2.22-133.1
glibc-devel-debuginfo - update to 2.22-133.1
glibc-devel-32bit - update to 2.22-133.1
glibc-devel - update to 2.22-133.1
glibc-debugsource - update to 2.22-133.1
glibc-debuginfo-32bit - update to 2.22-133.1
glibc-debuginfo - update to 2.22-133.1
glibc - update to 2.22-133.1
IBM Cloud Transformation Advisor - update to 3.10.0
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://bugzilla.redhat.com/show_bug.cgi?id=1347549
• https://sourceware.org/bugzilla/show_bug.cgi?id=20018

• Security restrictions bypass in Glibc getaddrinfo()
• OpenSUSE Linux update for glibc
• Red Hat update for glibc
• Red Hat update for glibc
• Amazon Linux AMI update for glibc
• Amazon Linux AMI update for python34, python35
• Amazon Linux AMI update for python36
• SUSE update for glibc
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Netcool Operations Insight
• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Multiple vulnerabilities in F5 BIG-IP Python component