CVE-2009-5029: Integer Overflow
Integer overflow in the tzfileread function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
Other sources
There exists a integer overflow to buffer overflow vulnerability within tzfileread function of the GNU C Library. This vulnerability was published by dividead early in 2009 in the following blog post:
http://dividead.wordpress.com/2009/06/01/glibc-timezone-integer-overflow/
In December 3, Kingcope, at Full Disclosure Mailing List, noted vsftpd as one possible attack vector for this issue:
http://lists.grok.org.uk/pipermail/full-disclosure/2011-December/084452.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-5029?
CVE-2009-5029 has a moderate severity rating as it can lead to denial of service and potentially remote code execution.
How do I fix CVE-2009-5029?
To fix CVE-2009-5029, upgrade glibc to version 2.15 or later.
What causes the vulnerability CVE-2009-5029?
CVE-2009-5029 is caused by an integer overflow in the __tzfile_read function of glibc.
Which versions of glibc are affected by CVE-2009-5029?
CVE-2009-5029 affects glibc versions earlier than 2.15, including various 2.0 to 2.14 versions.
What are the potential impacts of CVE-2009-5029?
The potential impacts of CVE-2009-5029 include application crashes and the risk of executing arbitrary code by attackers.