#VU12270 Spoofing attack in Glibc - CVE-2017-12132
Published: April 27, 2018
Vulnerability identifier: #VU12270
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-12132
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Glibc
Glibc
Software vendor:
GNU
GNU
Description
The vulnerability allows a remote attacker to perform spoofing attack and write arbitrary files on the target system.
The weakness exists in the DNS stub resolver due to soliciting large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation, when EDNS support is enabled. A remote attacker can write arbitrary files.
The weakness exists in the DNS stub resolver due to soliciting large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation, when EDNS support is enabled. A remote attacker can write arbitrary files.
Remediation
Update to version 2.26.