CVE-2016-10739: Input Validation
For historic reasons, inetaddr and inetaton accept trailing garbage. Some parsers rely on this (for example, libresolv when it parses “nameserver” directives in /etc/resolv.conf).
This causes problems because some applications assume that a successful parse as an IPv4 address means that the string consists of just an IPv4 address, and nothing more.
Glibc should add a check for trailing garbage and relegate the old behavior to a compatibility symbol.
For backporting, glibc should just fix getaddrinfo (and related functions if necessary) so that they will not accept trailing garbage.
Upstream bug : https://sourceware.org/bugzilla/showbug.cgi?id=20018
Additional note : When used in combination with flaw described in CVE-2016-5699, an attacker could direct an HTTP connection to a malicious server, using the following combined issues:
Python's httplib does not validate HTTP header values. A malicious 'Host' header with quoted new lines can inject additional headers and more glibc's getaddrinfo() ignores new lines and everything after a new line character when the first part looks like a IPv4 address
See the following blog post for additional information: http://blog.blindspotsecurity.com/2016/06/advisory-http-header-injection-in.html
Other sources
In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2016-10739?
CVE-2016-10739 has a medium severity rating due to potential for address parsing issues affecting applications.
How do I fix CVE-2016-10739?
To fix CVE-2016-10739, ensure that you upgrade to glibc versions 0:2.17-292.el7, 0:2.28-72.el8, or 2.29.
What systems are affected by CVE-2016-10739?
CVE-2016-10739 affects systems using glibc, specifically certain versions on Red Hat and openSUSE.
What kind of vulnerability is CVE-2016-10739?
CVE-2016-10739 is a vulnerability related to the improper handling of trailing garbage in IPv4 address parsing.
Can CVE-2016-10739 lead to security exploitation?
Yes, CVE-2016-10739 can potentially lead to security exploitation if applications incorrectly trust parsed input as valid.