CVE-2012-3404: Medium severity GNU glibc vulnerability
It was discovered that the formatted printing functionality in glibc did not properly honor the size of a structure when calculating the amount of memory to allocate. A remote attacker could provide a specially crafted sequence of format specifiers, leading to an undersized buffer allocation and subsequent stack corruption, resulting in a crash or, potentially, FORTIFYSOURCE format string protection mechanism bypass, when processed.
References: http://sourceware.org/bugzilla/showbug.cgi?id=12445 http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=84a4211850e3d23a9d3a4f3b294752a3b30bc0ff
Other sources
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3404?
The severity of CVE-2012-3404 is classified as high due to the potential for remote code execution.
How do I fix CVE-2012-3404?
To fix CVE-2012-3404, update the GNU C Library (glibc) to a version that includes the security patch.
Which software is affected by CVE-2012-3404?
CVE-2012-3404 affects versions of glibc 2.12 and certain versions of Red Hat and Ubuntu Linux.
Can CVE-2012-3404 lead to a buffer overflow?
Yes, CVE-2012-3404 can lead to a buffer overflow due to improper memory allocation when handling formatted printing.
Is CVE-2012-3404 being actively exploited?
At the time of its disclosure, CVE-2012-3404 was considered a potential target for exploitation, and users were advised to mitigate risks promptly.