Detections
Analytics
Amazon Linux AMI : gc (ALAS-2013-245)
medium Nessus Plugin ID 70907
Language:
Synopsis
The remote Amazon Linux AMI host is missing a security update.Description
It was discovered that gc's implementation of the malloc() and calloc() routines did not properly perform parameter sanitization when allocating memory. If an application using gc did not implement application-level validity checks for the malloc() and calloc() routines, a remote attacker could provide specially crafted application-specific input, which, when processed by the application, could lead to an application crash or, potentially, arbitrary code execution with the privileges of the user running the application.(CVE-2012-2673)
Solution
Run 'yum update gc' to update your system.See Also
Plugin Details
Severity: Medium
ID: 70907
File Name: ala_ALAS-2013-245.nasl
Version: 1.4
Type: Local
Agent: unix
Published: 11/14/2013
Updated: 4/18/2018
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.12
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:gc-debuginfo, p-cpe:/a:amazon:linux:gc, p-cpe:/a:amazon:linux:gc-devel, cpe:/o:amazon:linux
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Patch Publication Date: 11/4/2013
Reference Information
CVE: CVE-2012-2673