CVE-2013-4237: Buffer Overflow
An out-of buffer bounds write flaw was found in the way the readdirr function in glibc, the GNU C Library, handled a directory entry whose file name name contained more byte than the NAMEMAX characters constant indicated. An attacker could provide a specially-crafted (local) NTFS or (remote) CIFS file system that, when processed in an application using the readdirr() function, would cause that application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.
Upstream bug report: [1] http://sourceware.org/bugzilla/showbug.cgi?id=14699
Latest patch proposal: [2] http://sourceware.org/ml/libc-alpha/2013-05/msg00445.html
Other sources
sysdeps/posix/readdirr.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted (1) NTFS or (2) CIFS image.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4237?
CVE-2013-4237 is considered a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2013-4237?
To fix CVE-2013-4237, update the GNU C Library to version 2.19 or later.
What versions of GNU C Library are affected by CVE-2013-4237?
CVE-2013-4237 affects GNU C Library versions 2.0 through 2.18.
Can CVE-2013-4237 be exploited remotely?
Yes, CVE-2013-4237 can be exploited remotely if an attacker can manipulate directory entries.
What is the impact of CVE-2013-4237 on system security?
CVE-2013-4237 can lead to unexpected behavior, including potential crashes or arbitrary code execution, undermining system security.