CVE-2012-3418: Buffer Overflow
First published: Thu Jul 19 2012(Updated: )
Florian Weimer of the Red Hat Product Security Team discovered multiple integer and heap-based buffer overflow flaws in PCP (Performance Co-Pilot) libpcp protocol decoding functions. These flaws could lead to daemon crashes or the execution of arbitrary code with root privileges. Many of these flaws can be exploited without requiring the attacker to be authenticated.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/pcp | <3.6.5 | 3.6.5 |
| Performance Co-Pilot | <=3.6.4 | |
| Performance Co-Pilot | =2.1.1 | |
| Performance Co-Pilot | =2.1.2 | |
| Performance Co-Pilot | =2.1.3 | |
| Performance Co-Pilot | =2.1.4 | |
| Performance Co-Pilot | =2.1.5 | |
| Performance Co-Pilot | =2.1.6 | |
| Performance Co-Pilot | =2.1.7 | |
| Performance Co-Pilot | =2.1.8 | |
| Performance Co-Pilot | =2.1.9 | |
| Performance Co-Pilot | =2.1.10 | |
| Performance Co-Pilot | =2.1.11 | |
| Performance Co-Pilot | =2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085324.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-August/085333.html
- http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00024.html
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=blob;f=CHANGELOG;h=16c9cbb2f61d909487ea1c3171f4ab33e5648ac5;hb=fe51067ae869a4d59f350ac319b09edcb77ac8e6
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=b441980d53be1835b25f0cd6bcc0062da82032dd
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=babd6c5c527f87ec838c13a1b4eba612af6ea27c
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=e4faa1f0ba29151340920d975fc7639adf8371d5
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commit;h=f190942b552aa80d59bbe718866aa00b8e3fd5cc
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=49c679c44425915a8d6aa4af5f90b35384843c12
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=7eb479b91ef12bf89a15b078af2107c8c4746a4a
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=9f4e392c97ce42744ec73f82268ce6c815fdca0e
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=bfb3ab8c6b3d75b1a6580feee76a7d0925a3633c
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=cced6012b4b93bfb640a9678589ced5416743910
- http://oss.sgi.com/cgi-bin/gitweb.cgi?p=pcp/pcp.git;a=commitdiff;h=f0eaefe046b1061797f45b0c20bb2ac371b504a5
- http://www.debian.org/security/2012/dsa-2533
- http://www.openwall.com/lists/oss-security/2012/08/16/1
- https://bugzilla.redhat.com/show_bug.cgi?id=840822
- https://bugzilla.redhat.com/show_bug.cgi?id=840920
- https://bugzilla.redhat.com/show_bug.cgi?id=841112
- https://bugzilla.redhat.com/show_bug.cgi?id=841126
- https://bugzilla.redhat.com/show_bug.cgi?id=841159
- https://bugzilla.redhat.com/show_bug.cgi?id=841180
- https://bugzilla.redhat.com/show_bug.cgi?id=841183
- https://bugzilla.redhat.com/show_bug.cgi?id=841240
- https://bugzilla.redhat.com/show_bug.cgi?id=841249
- https://bugzilla.redhat.com/show_bug.cgi?id=841284
- https://bugzilla.redhat.com/show_bug.cgi?id=841698
- https://hermes.opensuse.org/messages/15471040
- https://hermes.opensuse.org/messages/15540133
- https://hermes.opensuse.org/messages/15540172
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=840822
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=840920
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841112
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841126
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841159
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841180
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841183
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841240
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841249
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841284
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841290
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841306
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=848629
- https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc16
- https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc17
- https://admin.fedoraproject.org/updates/pcp-3.6.5-1.fc18
- https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el5
- https://admin.fedoraproject.org/updates/pcp-3.6.5-1.el6
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=841698#c1
- https://access.redhat.com/security/cve/CVE-2012-3418
Frequently Asked Questions
What is the severity of CVE-2012-3418?
CVE-2012-3418 has a severity rating that indicates it can lead to a denial of service and potentially allows for arbitrary code execution.
How do I fix CVE-2012-3418?
To mitigate CVE-2012-3418, upgrade to Performance Co-Pilot version 3.6.5 or later.
What systems are affected by CVE-2012-3418?
CVE-2012-3418 affects Performance Co-Pilot versions prior to 3.6.5, including various 2.x versions.
Can CVE-2012-3418 be exploited remotely?
Yes, CVE-2012-3418 can be exploited by remote attackers to trigger a denial of service.
What is the common impact of CVE-2012-3418?
The common impact of CVE-2012-3418 includes service interruptions and potential unauthorized execution of code.
- collector/redhat-bugzilla
- alias/CVE-2012-3418
- agent/weakness
- agent/references
- agent/author
- agent/first-publish-date
- agent/tags
- agent/event
- agent/remedy
- agent/softwarecombine
- agent/last-modified-date
- agent/description
- agent/severity
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/sgi
- canonical/performance co-pilot
- version/performance co-pilot/3.6.4
- version/performance co-pilot/2.1.1
- version/performance co-pilot/2.1.2
- version/performance co-pilot/2.1.3
- version/performance co-pilot/2.1.4
- version/performance co-pilot/2.1.5
- version/performance co-pilot/2.1.6
- version/performance co-pilot/2.1.7
- version/performance co-pilot/2.1.8
- version/performance co-pilot/2.1.9
- version/performance co-pilot/2.1.10
- version/performance co-pilot/2.1.11
- version/performance co-pilot/2.2