GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
BID:99127
Info
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
| Bugtraq ID: | 99127 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2017-1000366 |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 19 2017 12:00AM |
| Updated: | Sep 05 2017 08:13PM |
| Credit: | Qualys Research Labs |
| Vulnerable: |
Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 Redhat Enterprise Linux 5 Oracle VM Server for x86 3.4 Oracle VM Server for x86 3.3 Oracle Linux 7 Oracle Linux 6 McAfee Web Gateway 7.7 McAfee Web Gateway 7.7.2.2 McAfee Web Gateway 7.6.2.4 McAfee Web Gateway 7.6.2.3 McAfee Web Gateway 7.6.2.2 McAfee Web Gateway 7.6.2.14 McAfee Web Gateway 7.6.2.1 McAfee Web Gateway 7.6.2.0 GNU glibc 2.22.90 GNU glibc 2.12.2 GNU glibc 2.12.1 GNU glibc 2.11.2 GNU glibc 2.11.1 GNU glibc 2.10.1 GNU glibc 2.2.5 GNU glibc 2.2.4 GNU glibc 2.2.3 GNU glibc 2.2.2 GNU glibc 2.2.1 GNU glibc 2.2 GNU glibc 2.1.9 GNU glibc 2.1.3 -10 GNU glibc 2.1.3 GNU glibc 2.1.2 GNU glibc 2.1.1 GNU glibc 2.1 GNU glibc 2.0.6 GNU glibc 2.0.5 GNU glibc 2.0.4 GNU glibc 2.0.3 GNU glibc 2.0.2 GNU glibc 2.0.1 GNU glibc 2.0 GNU glibc 2.25 GNU glibc 2.24 GNU glibc 2.23 GNU glibc 2.22 GNU glibc 2.21 GNU glibc 2.20 GNU glibc 2.19 GNU glibc 2.18 GNU glibc 2.17 GNU glibc 2.16 GNU glibc 2.15 GNU glibc 2.14.1 GNU glibc 2.14 GNU glibc 2.13 GNU glibc 2.12 GNU glibc 2.11.3 GNU glibc 2.11 GNU glibc 2.10 GNU glibc 2.1.3.10 GNU Cfengine 1.2.3 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 ia-30 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
McAfee Web Gateway 7.7.2.3 McAfee Web Gateway 7.6.2.15 |
Discussion
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
GNU glibc is prone to local memory-corruption vulnerability.
An attacker could exploit this issue to execute arbitrary code in the context of the application.
GNU glibc 2.25 and prior versions are vulnerable.
GNU glibc is prone to local memory-corruption vulnerability.
An attacker could exploit this issue to execute arbitrary code in the context of the application.
GNU glibc 2.25 and prior versions are vulnerable.
Exploit / POC
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
GNU glibc CVE-2017-1000366 Local Memory Corruption Vulnerability
References:
References:
- Bug 21624 (CVE-2017-1000366) - ld.so: Unsafe alloca allows local attackers to a (glibc)
- CVE-2017-1000366 (Red Hat)
- glibc Homepage (GNU)
- Bug 1452543 - (CVE-2017-1000366) CVE-2017-1000366 glibc: heap/stack gap jumping (Red Hat)
- Bug 21624 (CVE-2017-1000366) - ld.so: Unsafe alloca allows local attackers to a (bugzilla)
- Oracle Linux Bulletin - July 2017 (Oracle)
- Oracle VM Server for x86 Bulletin - July 2017 (Oracle)
- Qualys Security Advisory (Qualys )
- Web Gateway update fixes vulnerabilities CVE-2012-6706, CVE-2017-1000364, CVE-20 (McAfee)