The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.

An invalid free flaw was found in glibc's getaddrinfo() function when used with the AI_IDN flag. A remote attacker able to make an application call this function could use this flaw to execute arbitrary code with the permissions of the user running the application. Note that this flaw only affected applications using glibc compiled with libidn support. (CVE-2013-7424)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-1627 advisory.

    - Fix invalid-free when using getaddrinfo() and AI_IDN (CVE-2013-7424,

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated glibc packages that fix one security issue are now available for Red Hat Linux 5.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the Name Server Caching Daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

An invalid free flaw was found in glibc's getaddrinfo() function when used with the AI_IDN flag. A remote attacker able to make an application call this function could use this flaw to execute arbitrary code with the permissions of the user running the application. Note that this flaw only affected applications using glibc compiled with libidn support. (CVE-2013-7424)

All glibc users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6. (CVE-2013-7424)

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library.

#553206 CVE-2015-1472 CVE-2015-1473

The scanf family of functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2012-3405

The printf family of functions do not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service.

CVE-2012-3406

The printf family of functions do not properly limit stack allocation, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string.

CVE-2012-3480

Multiple integer overflows in the strtod, strtof, strtold, strtod_l, and other related functions allow local users to cause a denial of service (application crash) and possibly execute arbitrary code via a long string, which triggers a stack-based buffer overflow.

CVE-2012-4412

Integer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.

CVE-2012-4424

Stack-based buffer overflow in the strcoll and wcscoll functions allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.

CVE-2013-0242

Buffer overflow in the extend_buffers function in the regular expression matcher allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.

CVE-2013-1914 CVE-2013-4458

Stack-based buffer overflow in the getaddrinfo function allows remote attackers to cause a denial of service (crash) via a hostname or IP address that triggers a large number of domain conversion results.

CVE-2013-4237

readdir_r allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a malicious NTFS image or CIFS service.

CVE-2013-4332

Multiple integer overflows in malloc/malloc.c allow context-dependent attackers to cause a denial of service (heap corruption) via a large value to the pvalloc, valloc, posix_memalign, memalign, or aligned_alloc functions.

CVE-2013-4357

The getaliasbyname, getaliasbyname_r, getaddrinfo, getservbyname, getservbyname_r, getservbyport, getservbyport_r, and glob functions do not properly limit stack allocation, which allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2013-4788

When the GNU C library is statically linked into an executable, the PTR_MANGLE implementation does not initialize the random value for the pointer guard, so that various hardening mechanisms are not effective.

CVE-2013-7423

The send_dg function in resolv/res_send.c does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.

CVE-2013-7424

The getaddrinfo function may attempt to free an invalid pointer when handling IDNs (Internationalised Domain Names), which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code.

CVE-2014-4043

The posix_spawn_file_actions_addopen function does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.

For the oldstable distribution (squeeze), these problems have been fixed in version 2.11.3-4+deb6u5.

For the stable distribution (wheezy), these problems were fixed in version 2.13-38+deb7u8 or earlier.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been fixed in eglibc, Debian's version of the GNU C library :

  - CVE-2012-3406     The vfprintf function in stdio-common/vfprintf.c in GNU     C Library (aka glibc) 2.5, 2.12, and probably other     versions does not 'properly restrict the use of' the     alloca function when allocating the SPECS array, which     allows context-dependent attackers to bypass the     FORTIFY_SOURCE format-string protection mechanism and     cause a denial of service (crash) or possibly execute     arbitrary code via a crafted format string using     positional parameters and a large number of format     specifiers, a different vulnerability than CVE-2012-3404     and CVE-2012-3405.

  - CVE-2013-7424     An invalid free flaw was found in glibc's getaddrinfo()     function when used with the AI_IDN flag. A remote     attacker able to make an application call this function     could use this flaw to execute arbitrary code with the     permissions of the user running the application. Note     that this flaw only affected applications using glibc     compiled with libidn support.

  - CVE-2014-4043     The posix_spawn_file_actions_addopen function in glibc     before 2.20 does not copy its path argument in     accordance with the POSIX specification, which allows     context-dependent attackers to trigger use-after-free     vulnerabilities.

  - CVE-2014-9402     The getnetbyname function in glibc 2.21 or earlier will     enter an infinite loop if the DNS backend is activated     in the system Name Service Switch configuration, and the     DNS resolver receives a positive answer while processing     the network name.

  - CVE-2015-1472 / CVE-2015-1473     Under certain conditions wscanf can allocate too little     memory for the to-be-scanned arguments and overflow the     allocated buffer. The incorrect use of     '__libc_use_alloca (newsize)' caused a different (and     weaker) policy to be enforced which could allow a denial     of service attack.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1391 advisory.

    The glibc packages provide the standard C libraries (libc), POSIX thread     libraries (libpthread), standard math libraries (libm), and the Name     Server Caching Daemon (nscd) used by multiple programs on the system.
    Without these libraries, the Linux system cannot function correctly.

    An out-of-bounds write flaw was found in the way the glibc's readdir_r()     function handled file system entries longer than the NAME_MAX character     constant. A remote attacker could provide a specially crafted NTFS or CIFS     file system that, when processed by an application using readdir_r(), would     cause that application to crash or, potentially, allow the attacker to     execute arbitrary code with the privileges of the user running the     application. (CVE-2013-4237)

    It was found that getaddrinfo() did not limit the amount of stack memory     used during name resolution. An attacker able to make an application     resolve an attacker-controlled hostname or IP address could possibly cause     the application to exhaust all stack memory and crash. (CVE-2013-4458)

    These updated glibc packages also include several bug fixes and two     enhancements. Space precludes documenting all of these changes in this     advisory. Users are directed to the Red Hat Enterprise Linux 6.6 Technical     Notes, linked to in the References section, for information on the most     significant of these changes.

    All glibc users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
85498	Scientific Linux Security Update : glibc on SL5.x i386/x86_64 (20150817)	Nessus	Scientific Linux Local Security Checks	medium
85487	Oracle Linux 5 : glibc (ELSA-2015-1627)	Nessus	Oracle Linux Local Security Checks	critical
85459	CentOS 5 : glibc (CESA-2015:1627)	Nessus	CentOS Local Security Checks	medium
85442	RHEL 5 : glibc (RHSA-2015:1627)	Nessus	Red Hat Local Security Checks	medium
82905	F5 Networks BIG-IP : glibc vulnerability (K16472)	Nessus	F5 Networks Local Security Checks	medium
82149	Debian DLA-165-1 : eglibc security update	Nessus	Debian Local Security Checks	high
81448	Debian DSA-3169-1 : eglibc - security update	Nessus	Debian Local Security Checks	high
78408	RHEL 6 : glibc (RHSA-2014:1391)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2013-7424

critical

Tenable Plugins

medium

critical

medium

medium

medium

high

high

high