CVE-2013-1914: Buffer Overflow
A stack (frame) overflow flaw, leading to denial of service (application crash), was found in the way getaddrinfo() routine (returning a list of address structures for particular request) of glibc, the collection of GNU libc libraries, processed certain requests. If an application linked against glibc accepted untrusted getaddrinfo() input remotely, a remote attacker could issue a specially-crafted request, which once processed would lead to that application crash.
References: [1] https://bugzilla.novell.com/showbug.cgi?id=813121 [2] http://www.openwall.com/lists/oss-security/2013/04/03/2
Proposed Novell patch: [3] http://bugzillafiles.novell.org/attachment.cgi?id=533210
Other sources
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1914?
CVE-2013-1914 has a severity rating of medium, primarily impacting systems that use vulnerable versions of the GNU C Library (glibc).
How do I fix CVE-2013-1914?
To fix CVE-2013-1914, update to a version of glibc that is higher than 2.17 or apply the appropriate security patch provided by your Linux distribution.
Which versions of glibc are affected by CVE-2013-1914?
CVE-2013-1914 affects glibc versions up to and including 2.17, along with several earlier versions starting from 2.0.1.
What type of vulnerability is CVE-2013-1914?
CVE-2013-1914 is classified as a stack overflow vulnerability that can lead to application crashes and denial of service.
Is CVE-2013-1914 remotely exploitable?
Yes, CVE-2013-1914 can be exploited remotely if an application that uses the vulnerable glibc function is not properly secured.