Vulnerability in GNU C Library Allows Denial of Service and Code Execution
CVE-2012-3406

Currently unrated

Key Information:

Vendor
Canonical
Status
Ubuntu Linux
Enterprise Linux
Enterprise Virtualization
Glibc
Vendor
CVE Published:
10 February 2014

Summary

The vfprintf function in GNU C Library versions 2.5, 2.12, and potentially other versions lacks proper restrictions on the alloca function while allocating the SPECS array. This oversight can enable attackers to exploit the system by bypassing the FORTIFY_SOURCE format-string protection mechanism. As a result, this vulnerability may lead to a denial of service, causing the system to crash, or enable the execution of arbitrary code through crafted format strings with positional parameters and numerous format specifiers. This vulnerability presents a significant threat to system integrity and stability.

References

http://rhn.redhat.com/errata/RHSA-2012-1200.html
vendor-advisoryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=826943
x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2012-1097.html
vendor-advisoryx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.