Russian Vulnerability Scanner Database

Back to List

BDU:2016-00434

Scores

EPSS

0.000none0.0%
0%20%40%60%80%100%

Percentile: 0.0%

CVSS

9.3critical2.0
0246810

CVSS Score: 9.3/10

All CVSS Scores

CVSS 2.0
9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Description

Уязвимость компонента libresolv библиотеки glibc связана с множественными переполнениями буфера на стеке в функциях send_dg и send_vc. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании или выполнить произвольный код путем отправки специально сформированных DNS запросов, активирующих вызов функции getaddrinfo() с параметрами AF_UNSPEC или AF_INET6 семейств адресов, что приводит к созданию двух параллельных запросов А и AAAA, выполнение которых может вызвать выход за границы памяти

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.
Learn more about Scaner-VS 7

Sources

bdu

Related Vulnerabilities

CVE-2015-7547

Exploits

Exploit ID: 39454

Source: exploitdb

URL: https://www.exploit-db.com/exploits/39454

Exploit ID: 40339

Source: exploitdb

URL: https://www.exploit-db.com/exploits/40339

Exploit ID: CVE-2015-7547

Source: github-poc

URL: https://github.com/Amilaperera12/Glibc-Vulnerability-Exploit-CVE-2015-7547

Reference Links

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7547
https://support.f5.com/kb/en-us/solutions/public/k/47/sol47098834.html
https://sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://bugzilla.redhat.com/show_bug.cgi?id=1293532
https://access.redhat.com/articles/2161461
https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
http://ubuntu.com/usn/usn-2900-1
https://www.sourceware.org/ml/libc-alpha/2016-02/msg00416.html
https://github.com/fjserna/CVE-2015-7547

Recommendations

Source: bdu

Обновление библиотеки до версии 2.23 или более новой

URL: https://bdu.fstec.ru/vul/2016-00434

Vulnerable Software (10)

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 6.6 Advanced Update Support

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 7.1 Advanced Update Support

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 6

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: ubuntu 14.04 LTS

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: ubuntu 12.04 LTS

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 7

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 6.2 Advanced Update Support

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 6.5 Advanced Update Support

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: ubuntu 15.10

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

Type: Configuration

Vendor: the gnu project

Product: glibc

Operating System: red hat enterprise linux 6.4 Advanced Update Support

Trait: 
{  "version_end_excluding": "2.23"}

Source: bdu

End of list