Stack-based buffer overflow in GNU C Library (glibc) - CVE-2012-3480

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a long string, which triggers a stack-based buffer overflow. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2012-3480

Links to Public Exploits and PoC-codes

• Exploit #4373 - GNU glibc - Multiple Local Stack Buffer Overflow Vulnerabilities (August 11, 2020)

External References

• http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085190.html
• http://osvdb.org/84710
• http://rhn.redhat.com/errata/RHSA-2012-1207.html
• http://rhn.redhat.com/errata/RHSA-2012-1208.html
• http://rhn.redhat.com/errata/RHSA-2012-1262.html
• http://rhn.redhat.com/errata/RHSA-2012-1325.html
• http://secunia.com/advisories/50201
• http://secunia.com/advisories/50422
• http://sourceware.org/bugzilla/show_bug.cgi?id=14459
• http://sourceware.org/ml/libc-alpha/2012-08/msg00202.html
• http://www.openwall.com/lists/oss-security/2012/08/13/4
• http://www.openwall.com/lists/oss-security/2012/08/13/6
• http://www.securityfocus.com/bid/54982
• http://www.securitytracker.com/id?1027374
• http://www.ubuntu.com/usn/USN-1589-1
• https://security.gentoo.org/glsa/201503-04

Related Security Bulletins

• Multiple vulnerabilities in GNU Glibc
• Amazon Linux AMI update for glibc
• Slackware Linux update for glibc
• Gentoo update for GNU C Library