Published: 13/01/2011 Updated: 10/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 510

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) up to and including 2.11.3, and 2.12.x up to and including 2.12.2, allows context-dependent malicious users to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnu glibc 1.00
gnu glibc 1.01
gnu glibc 1.07
gnu glibc 1.06
gnu glibc 2.1.3.10
gnu glibc 2.1.9
gnu glibc 2.11.3
gnu glibc 2.12.2
gnu glibc 1.09.1
gnu glibc 1.09
gnu glibc 1.08
gnu glibc 2.1.2
gnu glibc 2.1.3
gnu glibc 2.10
gnu glibc 2.10.1
gnu glibc 1.05
gnu glibc 1.04
gnu glibc 2.1
gnu glibc 2.10.2
gnu glibc 2.12.0
gnu glibc 2.12.1
gnu glibc 2.11
gnu glibc 1.03
gnu glibc 1.02
gnu glibc 2.1.1
gnu glibc 2.1.1.6
gnu glibc 2.11.1
gnu glibc 2.11.2

// source: securityreasoncom/securityalert/8003 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ GNU libc/regcomp(3) Multiple Vulnerabilities ] Author: Maksymilian Arciemowicz securityreasoncom/ cxibnet/ Date: - - Dis: 01102010 - - Pub: 07012011 CERT: VU#912279 CVE: CVE-2010-4051 CVE-2010-4052 Affected (tested): - ...

source: wwwsecurityfocuscom/bid/45233/info GNU glibc is prone to a denial-of-service vulnerability due to stack exhaustion Successful exploits will allow attackers to make the affected computer unresponsive, denying service to legitimate users This issue affects unknown versions of the glibc library This BID will be updated when more ...

Recursion and bad memory management in BSD's libc/regcomp(3) can cause denial of service conditions ...

Mac OS X, Safari, Firefox and Kaspersky all suffer from a regular expression denial of service condition that was discovered long ago in regcomp() ...

CWE-399 http://seclists.org/fulldisclosure/2011/Jan/78 http://securityreason.com/achievement_securityalert/93 http://www.securityfocus.com/bid/45233 https://bugzilla.redhat.com/show_bug.cgi?id=645859 http://cxib.net/stuff/proftpd.gnu.c http://www.kb.cert.org/vuls/id/912279 http://secunia.com/advisories/42547 http://securityreason.com/securityalert/8003 http://securitytracker.com/id?1024832 http://www.exploit-db.com/exploits/15935 http://www.securityfocus.com/archive/1/515589/100/0/threaded https://nvd.nist.gov https://www.exploit-db.com/exploits/15935/https://www.kb.cert.org/vuls/id/912279

CVE-2010-4052

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect