CVE-2011-2702:Integer signedness error in Glibc before 2.13 and eglibc before 2.13 allows attackers to execute arbitrary code via a negative length parameter to certain functions, leading to an out-of-bounds read.

splash
Back

Description Preview

The vulnerability in Glibc before version 2.13 and eglibc before version 2.13 is due to an integer signedness error when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization. Attackers can exploit this issue by providing a negative length parameter to specific functions, such as memcpy and memset, in the sysdeps/i386/i686/multiarch/ directory. This can trigger an out-of-bounds read, potentially leading to arbitrary code execution.

Overview

This vulnerability in Glibc and eglibc versions prior to 2.13 allows context-dependent attackers to execute arbitrary code by leveraging the integer signedness error in SSSE3 optimization. By providing a negative length parameter to certain functions, an out-of-bounds read can be triggered, leading to potential code execution.

Remediation

To remediate this vulnerability, users are advised to update their Glibc or eglibc installations to version 2.13 or newer. It is crucial to apply the latest security patches provided by the respective vendors to mitigate the risk of exploitation. Additionally, organizations should monitor for any signs of unauthorized access or malicious activity on systems that may be affected by this vulnerability.

References

  1. [Bugzilla] https://bugzilla.novell.com/show_bug.cgi?id=706915
  2. [oss-security] 20110718 CVE id request: (e)glibc - http://seclists.org/oss-sec/2011/q3/123
  3. [xorl blog] http://xorl.wordpress.com/2011/08/06/cve-2011-2702-eglibc-and-glibc-signedness-issue/
  4. [Nodefense] http://www.nodefense.org/eglibc.txt
  5. [oss-security] 20110720 Re: CVE id request: (e)glibc - http://seclists.org/oss-sec/2011/q3/153
  6. [Sourceware] https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=a0ac24d98ace90d1ccba6a2f3e7d55600f2fdb6e
  7. [OSVDB] http://www.osvdb.org/80718
  8. [eglibc ChangeLog] http://www.eglibc.org/cgi-bin/viewvc.cgi/trunk/libc/ChangeLog?view=markup&pathrev=10032

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Health Care & Social Assistance
    Health Care & Social Assistance
  2. Manufacturing
    Manufacturing
  3. Retail Trade
    Retail Trade
  4. Utilities
    Utilities
  5. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  6. Finance and Insurance
    Finance and Insurance
  7. Other Services (except Public Administration)
    Other Services (except Public Administration)
  8. Accommodation & Food Services
    Accommodation & Food Services
  9. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  10. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  11. Construction
    Construction
  12. Educational Services
    Educational Services
  13. Information
    Information
  14. Management of Companies & Enterprises
    Management of Companies & Enterprises
  15. Mining
    Mining
  16. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  17. Public Administration
    Public Administration
  18. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  19. Transportation & Warehousing
    Transportation & Warehousing
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background