GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
BID:74255
Info
GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
| Bugtraq ID: | 74255 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2015-1781 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2015 12:00AM |
| Updated: | Sep 09 2016 06:00PM |
| Credit: | Arjun Shankar of Red Hat |
| Vulnerable: |
Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server EUS 6.6.z Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop 6 Oracle Linux 0 Oracle Enterprise Linux 7 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 IBM TSSC 7.4 IBM SmartCloud Entry 3.2 Appliance fix pack 1 IBM SmartCloud Entry 3.1 Appliance fix pack 1 IBM SmartCloud Entry 2.4 Appliance fix pack 4 IBM SmartCloud Entry 2.2 IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 Appliance FP IBM SmartCloud Entry 3.2.0.4 IBM SmartCloud Entry 3.2.0.3 IBM SmartCloud Entry 3.2.0.2 IBM SmartCloud Entry 3.2.0.1 IBM SmartCloud Entry 3.2.0.0 IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 Appliance FP IBM SmartCloud Entry 3.1.0.4 IBM SmartCloud Entry 3.1.0.3 IBM SmartCloud Entry 3.1.0.2 IBM SmartCloud Entry 3.1.0.1 IBM SmartCloud Entry 3.1.0.0 IBM SmartCloud Entry 2.4.0.3 Appliance FP IBM SmartCloud Entry 2.4.0 IBM SmartCloud Entry 2.3.0.3 Appliance FP IBM SmartCloud Entry 2.3.0 IBM SmartCloud Entry 2.2.0.3 Appliance FP IBM Security Virtual Server Protection for VMware 1.1.1 IBM Security Virtual Server Protection for VMware 1.1.0.1 IBM Security Virtual Server Protection for VMware 1.1 IBM Security Network Intrusion Prevention System GX7800 4.6.2 IBM Security Network Intrusion Prevention System GX7800 4.6.1 IBM Security Network Intrusion Prevention System GX7800 4.6 IBM Security Network Intrusion Prevention System GX7800 4.5 IBM Security Network Intrusion Prevention System GX7800 4.4 IBM Security Network Intrusion Prevention System GX7800 4.3 IBM Security Network Intrusion Prevention System GX7412-10 4.6.2 IBM Security Network Intrusion Prevention System GX7412-10 4.6.1 IBM Security Network Intrusion Prevention System GX7412-10 4.6 IBM Security Network Intrusion Prevention System GX7412-10 4.5 IBM Security Network Intrusion Prevention System GX7412-10 4.4 IBM Security Network Intrusion Prevention System GX7412-10 4.3 IBM Security Network Intrusion Prevention System GX7412-05 4.6.2 IBM Security Network Intrusion Prevention System GX7412-05 4.6.1 IBM Security Network Intrusion Prevention System GX7412-05 4.6 IBM Security Network Intrusion Prevention System GX7412-05 4.5 IBM Security Network Intrusion Prevention System GX7412-05 4.4 IBM Security Network Intrusion Prevention System GX7412-05 4.3 IBM Security Network Intrusion Prevention System GX7412 4.6.2 IBM Security Network Intrusion Prevention System GX7412 4.6.1 IBM Security Network Intrusion Prevention System GX7412 4.6 IBM Security Network Intrusion Prevention System GX7412 4.5 IBM Security Network Intrusion Prevention System GX7412 4.4 IBM Security Network Intrusion Prevention System GX7412 4.3 IBM Security Network Intrusion Prevention System GX6116 4.6.2 IBM Security Network Intrusion Prevention System GX6116 4.6.1 IBM Security Network Intrusion Prevention System GX6116 4.6 IBM Security Network Intrusion Prevention System GX6116 4.5 IBM Security Network Intrusion Prevention System GX6116 4.4 IBM Security Network Intrusion Prevention System GX6116 4.3 IBM Security Network Intrusion Prevention System GX5208-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5208-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5208-v2 4.6 IBM Security Network Intrusion Prevention System GX5208-v2 4.5 IBM Security Network Intrusion Prevention System GX5208-v2 4.4 IBM Security Network Intrusion Prevention System GX5208-v2 4.3 IBM Security Network Intrusion Prevention System GX5208 4.6.2 IBM Security Network Intrusion Prevention System GX5208 4.6.1 IBM Security Network Intrusion Prevention System GX5208 4.6 IBM Security Network Intrusion Prevention System GX5208 4.5 IBM Security Network Intrusion Prevention System GX5208 4.4 IBM Security Network Intrusion Prevention System GX5208 4.3 IBM Security Network Intrusion Prevention System GX5108-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5108-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5108-v2 4.6 IBM Security Network Intrusion Prevention System GX5108-v2 4.5 IBM Security Network Intrusion Prevention System GX5108-v2 4.4 IBM Security Network Intrusion Prevention System GX5108-v2 4.3 IBM Security Network Intrusion Prevention System GX5108 4.6.2 IBM Security Network Intrusion Prevention System GX5108 4.6.1 IBM Security Network Intrusion Prevention System GX5108 4.6 IBM Security Network Intrusion Prevention System GX5108 4.5 IBM Security Network Intrusion Prevention System GX5108 4.4 IBM Security Network Intrusion Prevention System GX5108 4.3 IBM Security Network Intrusion Prevention System GX5008-v2 4.6.2 IBM Security Network Intrusion Prevention System GX5008-v2 4.6.1 IBM Security Network Intrusion Prevention System GX5008-v2 4.6 IBM Security Network Intrusion Prevention System GX5008-v2 4.5 IBM Security Network Intrusion Prevention System GX5008-v2 4.4 IBM Security Network Intrusion Prevention System GX5008-v2 4.3 IBM Security Network Intrusion Prevention System GX5008 4.6.2 IBM Security Network Intrusion Prevention System GX5008 4.6.1 IBM Security Network Intrusion Prevention System GX5008 4.6 IBM Security Network Intrusion Prevention System GX5008 4.5 IBM Security Network Intrusion Prevention System GX5008 4.4 IBM Security Network Intrusion Prevention System GX5008 4.3 IBM Security Network Intrusion Prevention System GX4004-v2 4.6.2 IBM Security Network Intrusion Prevention System GX4004-v2 4.6.1 IBM Security Network Intrusion Prevention System GX4004-v2 4.6 IBM Security Network Intrusion Prevention System GX4004-v2 4.5 IBM Security Network Intrusion Prevention System GX4004-v2 4.4 IBM Security Network Intrusion Prevention System GX4004-v2 4.3 IBM Security Network Intrusion Prevention System GX4004 4.6.2 IBM Security Network Intrusion Prevention System GX4004 4.6.1 IBM Security Network Intrusion Prevention System GX4004 4.6 IBM Security Network Intrusion Prevention System GX4004 4.5 IBM Security Network Intrusion Prevention System GX4004 4.4 IBM Security Network Intrusion Prevention System GX4004 4.3 IBM Security Network Intrusion Prevention System GX4002 4.6.2 IBM Security Network Intrusion Prevention System GX4002 4.6.1 IBM Security Network Intrusion Prevention System GX4002 4.6 IBM Security Network Intrusion Prevention System GX4002 4.5 IBM Security Network Intrusion Prevention System GX4002 4.4 IBM Security Network Intrusion Prevention System GX4002 4.3 IBM Security Network Intrusion Prevention System GX3002 4.6.2 IBM Security Network Intrusion Prevention System GX3002 4.6.1 IBM Security Network Intrusion Prevention System GX3002 4.6 IBM Security Network Intrusion Prevention System GX3002 4.5 IBM Security Network Intrusion Prevention System GX3002 4.4 IBM Security Network Intrusion Prevention System GX3002 4.3 IBM Security Network Intrusion Prevention System GV200 4.6.2 IBM Security Network Intrusion Prevention System GV200 4.6.1 IBM Security Network Intrusion Prevention System GV200 4.6 IBM Security Network Intrusion Prevention System GV200 4.5 IBM Security Network Intrusion Prevention System GV200 4.4 IBM Security Network Intrusion Prevention System GV200 4.3 IBM Security Network Intrusion Prevention System GV1000 4.6.2 IBM Security Network Intrusion Prevention System GV1000 4.6.1 IBM Security Network Intrusion Prevention System GV1000 4.6 IBM Security Network Intrusion Prevention System GV1000 4.5 IBM Security Network Intrusion Prevention System GV1000 4.4 IBM Security Network Intrusion Prevention System GV1000 4.3 IBM Proventia Network Enterprise Scanner 2.3 IBM PowerKVM 3.1 IBM PowerKVM 2.1 IBM Power HMC 8.3.0.0 IBM Power HMC 8.2.0.0 IBM Power HMC 8.1.0.0 IBM IB6131 8 Gb Infiniband Switch 3.4 IBM IB6131 8 Gb Infiniband Switch 3.2 IBM Flex System EN6131 40Gb Ethernet Switch 3.4 IBM Flex System EN6131 40Gb Ethernet Switch 3.2 IBM Flex System Chassis Management Module 2PET IBM DS8800 86.31.167.0 (R6.3) IBM DS8800 0 IBM DS8700 87.51.14.X (R7.5) IBM DS8700 87.41.17.X (R7.4) IBM DS8700 76.31.143.0 (R6.3) IBM DataPower Gateways 7.2.0.0 IBM DataPower Gateways 7.1.0.5 IBM DataPower Gateways 7.0.0.8 IBM DataPower Gateways 6.0.1.11 IBM DataPower Gateways 6.0.0.15 GNU glibc 0 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 |
| Not Vulnerable: |
IBM TSSC 7.5 IBM Power HMC 8.8.3.0 IBM Power HMC 8.8.2.0 SP1 IBM Power HMC 8.8.1.0 SP2 IBM IB6131 8 Gb Infiniband Switch 3.5.1000 IBM Flex System EN6131 40Gb Ethernet Switch 3.5.1000 IBM Flex System Chassis Management Module 2PET14c-2.5.5c IBM DataPower Gateways 7.2.0.1 IBM DataPower Gateways 7.1.0.6 IBM DataPower Gateways 7.0.0.9 IBM DataPower Gateways 6.0.1.12 IBM DataPower Gateways 6.0.0.16 |
Discussion
GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
GNU glibc is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts may crash the application, denying service to legitimate users.
GNU glibc is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer.
An attacker can exploit these issues to execute arbitrary code in the context of the affected application. Failed exploit attempts may crash the application, denying service to legitimate users.
Exploit / POC
GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
GNU glibc CVE-2015-1781 Multiple Buffer Overflow Vulnerabilities
References:
References:
- Bug 1199525 - (CVE-2015-1781) CVE-2015-1781 glibc: buffer overflow in gethostbyn (Red Hat Bugzilla)
- GNU C Library Homepage (GNU)
- IBM swg21966788 : Vulnerabilities in GNU glibc affect IBM Security Network Intru (IBM)
- isg3T1022665: GNU C library (glibc) vulnerabilities affect IBM SmartCloud Entry (IBM)
- isg3T1023385:Multiple vulnerabilities in the GNU C Library (glibc) affect PowerK (IBM)
- Multiple vulnerabilities impact System Storage DS8000 Hardware Management Consol (IBM)
- Ref: linuxbulletinoct2015-2719645 Oracle Linux Bulletin - October 2015 Revision (Oracle)
- RHSA-2015:0863-1 Moderate: glibc security and bug fix update (Red Hat)
- Security Bulletin: Multiple vulnerabilities affect IBM Flex System Chassis Manag (IBM)
- Security Bulletin: TS3000 (TSSC/IMC) is affected by two issues for glibc (CVE-20 (IBM)
- Security Bulletin: Vulnerabilities in glibc affect Power Hardware Management Con (IBM)
- Security Bulletin: Vulnerabilities in NTP and GNU C Library (glibc) affect IBM F (IBM)
- swg21966209:Vulnerabilities in standard C library affect IBM DataPower Gateways (IBM)
- swg21982433:Security vulnerabilities in glibc affect IBM Security Proventia Netw (IBM)
- swg21988872: Vulnerabilities in GNU glibc affect IBM Security Virtual Server Pro (IBM)