製品・ソフトウェアに関する情報

JVN脆弱性詳細

GNU C Library の regcomp 実装におけるサービス運用妨害 (DoS) の脆弱性

Title	GNU C Library の regcomp 実装におけるサービス運用妨害 (DoS) の脆弱性
Summary	GNU C Library (glibc または libc6) の regcomp 実装には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。
Possible impacts	攻撃者により、隣接のバウンド反復を含む正規表現を介して、RE_DUP_MAX 制限を回避され、サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報及び参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 13, 2011, midnight
Registration Date	Jan. 21, 2011, 4:35 p.m.
Last Update	Jan. 21, 2011, 4:35 p.m.

Affected System

GNU Project

GNU C Library 2.12.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4051	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4051
National Vulnerability Database (NVD)
2	CVE-2010-4051	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4051

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
GNU C Library
1	Top Page	http://www.gnu.org/software/libc/libc.html

その他

No	Name	URL
JVN
1	JVNVU#912279	http://jvn.jp/cert/JVNVU912279
Secunia Advisory
2	SA42547	http://secunia.com/advisories/42547
SecurityFocus
3	45233	http://www.securityfocus.com/bid/45233
SecurityTracker
4	1024832	http://securitytracker.com/id?1024832
US-CERT Vulnerability Note
5	VU#912279	http://www.kb.cert.org/vuls/id/912279

Change Log

No	Changed Details	Date of change
0	[2011年01月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-4051

Summary	The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."
Publication Date	Jan. 14, 2011, 4 a.m.
Registration Date	Jan. 29, 2021, 11:07 a.m.
Last Update	Nov. 21, 2024, 10:20 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://cxib.net/stuff/proftpd.gnu.c	Patch
2	http://cxib.net/stuff/proftpd.gnu.c	Patch
3	http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
4	http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
5	http://secunia.com/advisories/42547	Vendor Advisory
6	http://secunia.com/advisories/42547	Vendor Advisory
7	http://securityreason.com/achievement_securityalert/93	Exploit
8	http://securityreason.com/achievement_securityalert/93	Exploit
9	http://securityreason.com/securityalert/8003	Exploit
10	http://securityreason.com/securityalert/8003	Exploit
11	http://securitytracker.com/id?1024832
12	http://securitytracker.com/id?1024832
13	http://www.exploit-db.com/exploits/15935
14	http://www.exploit-db.com/exploits/15935
15	http://www.kb.cert.org/vuls/id/912279	US Government Resource
16	http://www.kb.cert.org/vuls/id/912279	US Government Resource
17	http://www.securityfocus.com/archive/1/515589/100/0/threaded
18	http://www.securityfocus.com/archive/1/515589/100/0/threaded
19	http://www.securityfocus.com/bid/45233	Exploit
20	http://www.securityfocus.com/bid/45233	Exploit
21	https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit
22	https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit
23	https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E
24	https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E

Common Vulnerabilities List