GNU glibc 'send_dg()' Function Local Information Disclosure Weakness

Bugtraq ID:	72844
Class:	Design Error
CVE:	CVE-2013-7423
Remote:	No
Local:	Yes
Published:	Sep 12 2013 12:00AM
Updated:	Jul 06 2016 02:04PM
Credit:	arnaud.lb
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop 6 Oracle Linux 0 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 IBM Storwize V7000 Unified 1.3.1.0 IBM Storwize V7000 Unified 1.3.0.5 IBM Storwize V7000 Unified 1.3.0.0 GNU glibc 2.12.2 GNU glibc 2.12.1 GNU glibc 2.11.2 GNU glibc 2.11.1 GNU glibc 2.10.1 GNU glibc 2.2.5 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Gentoo Linux 0.7 + Gentoo Linux 0.5 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + Mandriva Linux Mandrake 9.0 + RedHat Linux 7.3 i386 + RedHat Linux 7.3 + Slackware Linux 8.1 GNU glibc 2.2.4 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + Conectiva Linux 8.0 + HP Secure OS software for Linux 1.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 ia64 + Mandriva Linux Mandrake 8.1 + Red Hat Enterprise Linux AS 2.1 IA64 + Red Hat Enterprise Linux AS 2.1 + RedHat Enterprise Linux ES 2.1 IA64 + RedHat Enterprise Linux ES 2.1 + RedHat Enterprise Linux WS 2.1 IA64 + RedHat Enterprise Linux WS 2.1 + RedHat Linux 7.2 i686 + RedHat Linux 7.2 i386 + RedHat Linux 7.1 ia64 + RedHat Linux 7.1 i686 + RedHat Linux 7.1 i386 + RedHat Linux 7.1 alphaev6 + RedHat Linux 7.1 alpha + RedHat Linux 7.0 alphaev6 + RedHat Linux 7.0 i686 + RedHat Linux 7.0 i386 + RedHat Linux 7.0 alpha + RedHat Linux Advanced Work Station 2.1 + S.u.S.E. Linux 8.0 i386 + S.u.S.E. Linux 8.0 + S.u.S.E. Linux 7.3 sparc + S.u.S.E. Linux 7.3 ppc + S.u.S.E. Linux 7.3 i386 + S.u.S.E. Linux 7.3 + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Enterprise Server for S/390 + S.u.S.E. Linux Firewall on CD + S.u.S.E. SuSE eMail Server III + Sun Linux 5.0.7 + Sun Linux 5.0.6 + Sun Linux 5.0.5 + Sun Linux 5.0.3 + Sun Linux 5.0 + SuSE SUSE Linux Enterprise Server 7 GNU glibc 2.2.3 + Conectiva Linux 7.0 GNU glibc 2.2.2 + Mandriva Linux Mandrake 8.0 ppc + Mandriva Linux Mandrake 8.0 + S.u.S.E. Linux 7.2 i386 + S.u.S.E. Linux 7.2 GNU glibc 2.2.1 GNU glibc 2.2 + S.u.S.E. Linux 7.1 x86 + S.u.S.E. Linux 7.1 sparc + S.u.S.E. Linux 7.1 ppc + S.u.S.E. Linux 7.1 alpha + S.u.S.E. Linux 7.1 + Wirex Immunix OS 7+ GNU glibc 2.1.9 GNU glibc 2.1.3 + Conectiva Linux 6.0 + Conectiva Linux 5.1 + Conectiva Linux 5.0 + Conectiva Linux graficas + Conectiva Linux ecommerce + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 + EnGarde Secure Linux 1.0.1 + HP Secure OS software for Linux 1.0 + MandrakeSoft Corporate Server 1.0.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Openwall Openwall GNU/*/Linux 0.1 -stable + Red Hat Linux 6.2 + RedHat Linux 6.2 sparcv9 + RedHat Linux 6.2 sparc + RedHat Linux 6.2 i386 + RedHat Linux 6.2 alpha + S.u.S.E. Linux 7.0 sparc + S.u.S.E. Linux 7.0 ppc + S.u.S.E. Linux 7.0 i386 + S.u.S.E. Linux 7.0 alpha + S.u.S.E. Linux 7.0 + S.u.S.E. Linux 6.4 ppc + S.u.S.E. Linux 6.4 i386 + S.u.S.E. Linux 6.4 alpha + S.u.S.E. Linux 6.4 + Trustix Secure Linux 1.5 + Trustix Secure Linux 1.2 + Trustix Secure Linux 1.1 + Trustix Secure Linux 1.0 1 GNU glibc 2.1.2 GNU glibc 2.1.1 GNU glibc 2.1 GNU glibc 2.0.6 GNU glibc 2.0.5 GNU glibc 2.0.4 GNU glibc 2.0.3 GNU glibc 2.0.2 GNU glibc 2.0.1 GNU glibc 2.0 GNU glibc 2.14.1 GNU glibc 2.14 GNU glibc 2.13 GNU Cfengine 1.2.3 Gentoo Linux CentOS CentOS 6
Not Vulnerable:

GNU glibc 'send_dg()' Function Local Information Disclosure Weakness

GNU glibc is prone to a local information-disclosure weakness.

A local attacker may exploit this issue to gain access to potentially sensitive information.

Versions prior to GNU glibc 2.20 are vulnerable.

GNU glibc 'send_dg()' Function Local Information Disclosure Weakness

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GNU glibc 'send_dg()' Function Local Information Disclosure Weakness

References:

• Bug 1187109 - (CVE-2013-7423) CVE-2013-7423 glibc: getaddrinfo() writes DNS quer (Red hat Bugzilla)
  
• Bug 15946 - (CVE-2013-7423) getaddrinfo() writes DNS queries to random file desc (Sourceware Bugzilla)
  
• GNU C Library Homepage (GNU)
  
• Critical: Vulnerabilities in the glibc are open that could lead to a local or re (IBM)
  
• GNU C library (glibc) vulnerability affects IBM Security Access Manager for Mobi (IBM)
  
• IBM Advisory ssg1S1005315 (IBM)
  
• IBM Advisory ssg1S1005316 (IBM)
  
• isg3T1022665: GNU C library (glibc) vulnerabilities affect IBM SmartCloud Entry (IBM)
  
• isg3T1023385:Multiple vulnerabilities in the GNU C Library (glibc) affect PowerK (IBM)
  
• Multiple vulnerabilities in glibc affect IBM Flex System Manager(FSM) (CVE-2013- (IBM)
  
• pexip Security Bulletin: Multiple vulnerabilities (Pexip)
  
• Ref: linuxbulletinoct2015-2719645 Oracle Linux Bulletin - October 2015 Revision (Oracle)
  
• RHSA-2015:0863-1 Moderate: glibc security and bug fix update (Red Hat)
  
• Security Bulletin: GNU C library (glibc) vulnerability affects IBM Security Acce (IBM)
  
• Security Bulletin: IBM BladeCenter Advanced Management Module is affected by gli (IBM)
  
• Security Bulletin: Multiple vulnerabilities impact DS8000 HMC (IBM)
  
• Security Bulletin: Multiple vulnerabilities in glibc affect IBM Flex System Mana (IBM)
  
• Security Bulletin: TS3000 (TSSC/IMC) is affected by two issues for glibc (CVE-20 (IBM)
  
• Security Bulletin: Vulnerabilities in GNU C Library affect Power Hardware Manage (IBM)
  
• Security Bulletin: Vulnerability in glibc affects IBM Security Virtual Server Pr (IBM)
  
• swg21966209:Vulnerabilities in standard C library affect IBM DataPower Gateways (IBM)
  
• swg21969525:Vulnerability in Open Source GNU glibc affects IBM OS Images for Red (IBM)