GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
BID:71670
Info
GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
| Bugtraq ID: | 71670 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9402 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2014 12:00AM |
| Updated: | May 02 2018 09:00PM |
| Credit: | yashavanth.hsn |
| Vulnerable: |
Ubuntu Ubuntu Linux 14.10 Ubuntu Ubuntu Linux 14.04 LTS Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Pexip Pexip Infinity 8.0 Pexip Pexip Infinity 7.0 Pexip Pexip Infinity 6.0 Pexip Pexip Infinity 5.0 Pexip Pexip Infinity 4.0 Pexip Pexip Infinity 3.0 Pexip Pexip Infinity 2.0 Pexip Pexip Infinity 1.0 Oracle Linux 7.0 IBM Security Network Intrusion Prevention System GX7800 4.6.2 IBM Security Network Intrusion Prevention System GX7800 4.6.1 IBM Security Network Intrusion Prevention System GX7800 4.6 IBM Security Network Intrusion Prevention System GX7800 4.5 IBM Security Network Intrusion Prevention System GX7800 4.4 IBM Security Network Intrusion Prevention System GX7800 4.3 IBM Security Network Intrusion Prevention System GX7412-10 4.6.2 IBM Security Network Intrusion Prevention System GX7412-10 4.6.1 IBM Security Network Intrusion Prevention System GX7412-10 4.6 IBM Security Network Intrusion Prevention System GX7412-10 4.5 IBM Security Network Intrusion Prevention System GX7412-10 4.4 IBM Security Network Intrusion Prevention System GX7412-10 4.3 IBM Security Network Intrusion Prevention System GX7412-05 4.6.2 IBM Security Network Intrusion Prevention System GX7412-05 4.6.1 IBM Security Network Intrusion Prevention System GX7412-05 4.6 IBM Security Network Intrusion Prevention System GX7412-05 4.5 IBM Security Network Intrusion Prevention System GX7412-05 4.4 IBM Security Network Intrusion Prevention System GX7412-05 4.3 IBM Security Network Intrusion Prevention System GX7412 4.6.2 IBM Security Network Intrusion Prevention System GX7412 4.6.1 IBM Security Network Intrusion Prevention System GX7412 4.6 IBM Security Network Intrusion Prevention System GX7412 4.5 IBM Security Network Intrusion Prevention System GX7412 4.4 IBM Security Network Intrusion Prevention System GX7412 4.3 IBM Security Network Intrusion Prevention System GX6116 4.6.2 IBM Security Network Intrusion Prevention System GX6116 4.6.1 IBM Security Network Intrusion Prevention System GX6116 4.6 IBM Security Network Intrusion Prevention System GX6116 4.5 IBM Security Network Intrusion Prevention System GX6116 4.4 IBM Security Network Intrusion Prevention System GX6116 4.3 IBM Security Network Intrusion Prevention System GX5208-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5208-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5208-v2 4.6 IBM Security Network Intrusion Prevention System GX5208-v2 4.5 IBM Security Network Intrusion Prevention System GX5208-v2 4.4 IBM Security Network Intrusion Prevention System GX5208-v2 4.3 IBM Security Network Intrusion Prevention System GX5208 4.6.2 IBM Security Network Intrusion Prevention System GX5208 4.6.1 IBM Security Network Intrusion Prevention System GX5208 4.6 IBM Security Network Intrusion Prevention System GX5208 4.5 IBM Security Network Intrusion Prevention System GX5208 4.4 IBM Security Network Intrusion Prevention System GX5208 4.3 IBM Security Network Intrusion Prevention System GX5108-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5108-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5108-v2 4.6 IBM Security Network Intrusion Prevention System GX5108-v2 4.5 IBM Security Network Intrusion Prevention System GX5108-v2 4.4 IBM Security Network Intrusion Prevention System GX5108-v2 4.3 IBM Security Network Intrusion Prevention System GX5108 4.6.2 IBM Security Network Intrusion Prevention System GX5108 4.6.1 IBM Security Network Intrusion Prevention System GX5108 4.6 IBM Security Network Intrusion Prevention System GX5108 4.5 IBM Security Network Intrusion Prevention System GX5108 4.4 IBM Security Network Intrusion Prevention System GX5108 4.3 IBM Security Network Intrusion Prevention System GX5008-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5008-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5008-v2 4.6 IBM Security Network Intrusion Prevention System GX5008-v2 4.5 IBM Security Network Intrusion Prevention System GX5008-v2 4.4 IBM Security Network Intrusion Prevention System GX5008-v2 4.3 IBM Security Network Intrusion Prevention System GX5008 4.6.2 IBM Security Network Intrusion Prevention System GX5008 4.6.1 IBM Security Network Intrusion Prevention System GX5008 4.6 IBM Security Network Intrusion Prevention System GX5008 4.5 IBM Security Network Intrusion Prevention System GX5008 4.4 IBM Security Network Intrusion Prevention System GX5008 4.3 IBM Security Network Intrusion Prevention System GX4004-v2 4.6.2 IBM Security Network Intrusion Prevention System GX4004-v2 4.6.1 IBM Security Network Intrusion Prevention System GX4004-v2 4.6 IBM Security Network Intrusion Prevention System GX4004-v2 4.5 IBM Security Network Intrusion Prevention System GX4004-v2 4.4 IBM Security Network Intrusion Prevention System GX4004-v2 4.3 IBM Security Network Intrusion Prevention System GX4004 4.6.2 IBM Security Network Intrusion Prevention System GX4004 4.6.1 IBM Security Network Intrusion Prevention System GX4004 4.6 IBM Security Network Intrusion Prevention System GX4004 4.5 IBM Security Network Intrusion Prevention System GX4004 4.4 IBM Security Network Intrusion Prevention System GX4004 4.3 IBM Security Network Intrusion Prevention System GX4002 4.6.2 IBM Security Network Intrusion Prevention System GX4002 4.6.1 IBM Security Network Intrusion Prevention System GX4002 4.6 IBM Security Network Intrusion Prevention System GX4002 4.5 IBM Security Network Intrusion Prevention System GX4002 4.4 IBM Security Network Intrusion Prevention System GX4002 4.3 IBM Security Network Intrusion Prevention System GX3002 4.6.2 IBM Security Network Intrusion Prevention System GX3002 4.6.1 IBM Security Network Intrusion Prevention System GX3002 4.6 IBM Security Network Intrusion Prevention System GX3002 4.5 IBM Security Network Intrusion Prevention System GX3002 4.4 IBM Security Network Intrusion Prevention System GX3002 4.3 IBM Security Network Intrusion Prevention System GV200 4.6.2 IBM Security Network Intrusion Prevention System GV200 4.6.1 IBM Security Network Intrusion Prevention System GV200 4.6 IBM Security Network Intrusion Prevention System GV200 4.5 IBM Security Network Intrusion Prevention System GV200 4.4 IBM Security Network Intrusion Prevention System GV200 4.3 IBM Security Network Intrusion Prevention System GV1000 4.6.2 IBM Security Network Intrusion Prevention System GV1000 4.6.1 IBM Security Network Intrusion Prevention System GV1000 4.6 IBM Security Network Intrusion Prevention System GV1000 4.5 IBM Security Network Intrusion Prevention System GV1000 4.4 IBM Security Network Intrusion Prevention System GV1000 4.3 IBM Power HMC 7.7.9.0 IBM Power HMC 7.7.8.0 IBM Power HMC 7.7.7.0 IBM Power HMC 7.7.3.0 IBM Flex System Manager 1.3.2 0 IBM Flex System Manager 1.3.1.0 IBM Flex System Manager 1.3.0.1 IBM Flex System Manager 1.3.0.0 IBM Flex System Manager 1.2.1.0 IBM Flex System Manager 1.2.0.0 IBM Flex System Manager 1.1.0.0 IBM DS8870 R7.5 IBM BladeCenter(TM)-T 8730 0 IBM BladeCenter(TM)-T 8720 0 IBM BladeCenter(TM)-S 8886 0 IBM BladeCenter(TM)-S 7779 0 IBM BladeCenter(TM)-S 1948 0 IBM BladeCenter(TM)-HT 8750 0 IBM BladeCenter(TM)-HT 8740 0 IBM BladeCenter(TM)-H 8852 IBM BladeCenter(TM)-H 7989 IBM BladeCenter(TM)-H 1886 IBM BladeCenter(TM)-E 8677 IBM BladeCenter(TM)-E 7967 IBM BladeCenter(TM)-E 1881 IBM BladeCenter T Advanced Management Module 32R0835 IBM BladeCenter Advanced Management Module 25R5778 GNU glibc 2.12.2 GNU glibc 2.12.1 GNU glibc 2.11.2 GNU glibc 2.11.1 GNU glibc 2.10.1 GNU glibc 2.5 GNU glibc 2.3.10 GNU glibc 2.3.4 GNU glibc 2.3.3 GNU glibc 2.3.2 GNU glibc 2.3.1 GNU glibc 2.3 GNU glibc 2.2.5 GNU glibc 2.2.4 GNU glibc 2.2.3 GNU glibc 2.2.2 GNU glibc 2.2.1 GNU glibc 2.2 GNU glibc 2.1.9 GNU glibc 2.1.3 GNU glibc 2.1.2 GNU glibc 2.1.1 GNU glibc 2.1 GNU glibc 2.0.6 GNU glibc 2.0.5 GNU glibc 2.0.4 GNU glibc 2.0.3 GNU glibc 2.0.2 GNU glibc 2.0.1 GNU glibc 2.0 GNU glibc 2.9 GNU glibc 2.8 GNU glibc 2.7 GNU glibc 2.6.1 GNU glibc 2.6 GNU glibc 2.5.1 GNU glibc 2.4 GNU glibc 2.3.6 GNU glibc 2.3.5 GNU glibc 2.21 GNU glibc 2.20 GNU glibc 2.19 GNU glibc 2.18 GNU glibc 2.17 GNU glibc 2.16 GNU glibc 2.15 GNU glibc 2.14.1 GNU glibc 2.14 GNU glibc 2.13 GNU glibc 2.12 GNU glibc 2.11.3 GNU glibc 2.11 GNU Cfengine 1.2.3 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Pexip Pexip Infinity 9.0 |
Discussion
GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
GNU glibc is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to cause the application to enter an infinite loop which may cause denial-of-service.
GNU glibc is prone to a remote denial-of-service vulnerability.
Attackers can exploit this issue to cause the application to enter an infinite loop which may cause denial-of-service.
Exploit / POC
GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
References
GNU glibc 'getanswer_r()' Function Infinite Loop Denial of Service Vulnerability
References:
References:
- Bug 17630 - endless loop in getaddr_r (yashavanth.hsn)
- GNU C Library Homepage (GNU)
- IBM Security Network Intrusion Prevention System is affected by glibc vulnerabil (IBM)
- Multiple vulnerabilities in glibc affect IBM Flex System Manager(FSM) (CVE-2013- (IBM)
- Oracle Linux Bulletin - April 2018 (Oracle)
- pexip Security Bulletin: Multiple vulnerabilities (Pexip)
- Security Bulletin: IBM BladeCenter Advanced Management Module is affected by gli (IBM)
- Security Bulletin: Multiple vulnerabilities impact DS8000 HMC (IBM)
- Security Bulletin: Multiple vulnerabilities in glibc affect IBM Flex System Mana (IBM)
- Security Bulletin: Vulnerabilities in GNU C Library affect Power Hardware Manage (IBM)