Common Vulnerabilities and Exposures assigned an identifier CVE-2009-4881 to the following vulnerability:
Integer overflow in the vstrfmonl function in stdlib/strfmonl.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
References: [1] http://sources.redhat.com/bugzilla/showbug.cgi?id=10600 [2] http://sourceware.org/git/?p=glibc.git;a=commit;h=153aa31b93be22e01b236375fb02a9f9b9a0195f [3] http://sources.redhat.com/bugzilla/showbug.cgi?id=10600 [4] http://securityreason.com/achievementsecurityalert/53 [5] http://xorl.wordpress.com/2009/04/11/cve-2008-1391-netbsd-strfmon-integer-overflow/
Public PoC (from [4]):
#include <stdio.h> #include <monetary.h>
int main(int argc, char argv[]){ char buff[51]; char bux=buff; int res;
res=strfmon(bux, 50, argv[1], "0"); return 0; }
cxib# ./pln %99999999999999999999n
glibc2 does not properly clear the LDDEBUGOUTPUT and LDDEBUG environmental variables when a program is spawned from a setuid program, which could allow local users to overwrite files via a symlink attack.
The Sun RPC functionality in multiple libc implementations does not provide a time-out mechanism when reading data from TCP connections, which allows remote attackers to cause a denial of service (hang).
GNU glibc 2.3.4 before 2.3.4.20040619, 2.3.3 before 2.3.3.20040420, and 2.3.2 before 2.3.2-r10 does not restrict the use of LDDEBUG for a setuid program, which allows local users to gain sensitive information, such as the list of symbols used by the program.
The glibcbug script in glibc 2.3.4 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2004-0968.
The catchsegv script in glibc 2.3.2 and earlier allows local users to overwrite files via a symlink attack on temporary files.
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Maksymilian Arciemowicz reported a deficiency in the way glibc regular expression engine processed certain patterns. A local attacker could use this flaw to cause a denial of service (crash due stack overflow).
Note: The above described behavior is a limitation of glibc regular expression engine. Regular expression matching function is called recursively for certain types of patterns (where subexpression using quantifier is nested inside of another quantified expression), where long input can result in deep recursion and exhaustion of all stack memory (i.e. impact is limited to crash). Amount of stack memory available to glibc regular expression engine influences the size of input that must be provided to trigger the crash. Alternatively, expression can be modified to avoid quantification nesting, or program modified to limit size of input passed to regular expression engine.
Conclusion: Due the above described behavior Red Hat Security Response Team would not classify this deficiency to be a security issue.
References: [1] http://www.kb.cert.org/vuls/id/912279 [2] http://www.securityfocus.com/archive/1/515589 [3] http://forums.cnet.com/7726-6132102-5042238.html [4] http://secunia.com/advisories/42547/ [5] http://securityreason.com/securityalert/8003