Path traversal in GNU C Library (glibc) - CVE-2014-0475

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41440

Path traversal in GNU C Library (glibc) - CVE-2014-0475

Published: July 29, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41440
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0475
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.


Affected software

GNU C Library (glibc)
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Slackware Linux
glibc
glibc-i18n
glibc-profile
glibc-solibs
sys-libs/glibc
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1
TMS RAMSAN 710 and 810 Machine Type 9834 -AS1 and -AE1
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2

How to mitigate CVE-2014-0475

Install update from vendor's website.

glibc - update to 2.17
glibc-i18n - update to 2.17
glibc-profile - update to 2.17
glibc-solibs - update to 2.17
sys-libs/glibc - update to 2.21-r2
TMS RAMSAN 710 & 810 Machine Type 9833 -AS1 & -AE1 - update to 5.6.2
FlashSystem 710 & 810 Machine Type 9830 -AS1 & -AE1 - update to 5.6.2
TMS RAMSAN 710 and 810 Machine Type 9834 -AS1 and -AE1 - update to 6.3.2
IBM FlashSystem 720 and 820 Machine Type 9831 –AS2 and -AE2 - update to 6.3.2

External References

Related Security Bulletins