CVE-2012-3406: Medium severity GNU glibc vulnerability
It was discovered that the formatted printing functionality in glibc did not properly restrict the use of alloca(). A remote attacker could provide a specially crafted sequence of format specifiers, leading to a crash or, potentially, FORTIFYSOURCE format string protection mechanism bypass, when processed.
Other sources
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFYSOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3406?
CVE-2012-3406 has a moderate severity rating due to the potential for a crash or format string protection bypass.
How do I fix CVE-2012-3406?
To fix CVE-2012-3406, update the GNU C Library (glibc) to a patched version that addresses the vulnerability.
What versions are affected by CVE-2012-3406?
CVE-2012-3406 affects glibc versions 2.5 and 2.12, along with several specific versions of Red Hat Enterprise and Ubuntu Linux.
Can CVE-2012-3406 be exploited remotely?
Yes, a remote attacker could exploit CVE-2012-3406 by sending specially crafted input sequences.
What are the potential impacts of CVE-2012-3406?
The potential impacts of CVE-2012-3406 include application crashes and the risk of bypassing security mechanisms.