製品・ソフトウェアに関する情報

JVN脆弱性詳細

GNU C Library の regcomp 実装におけるスタック消費の脆弱性

Title	GNU C Library の regcomp 実装におけるスタック消費の脆弱性
Summary	GNU C Library (glibc または libc6) の regcomp 実装には、スタック消費の脆弱性が存在します。
Possible impacts	攻撃者により、隣接のバウンド操作を含む正規表現を介して、サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報及び参考情報を参照して適切な対策を実施してください。
Publication Date	Jan. 13, 2011, midnight
Registration Date	Jan. 21, 2011, 4:37 p.m.
Last Update	Jan. 21, 2011, 4:37 p.m.

Affected System

GNU Project

GNU C Library 2.12.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4052	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4052
National Vulnerability Database (NVD)
2	CVE-2010-4052	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4052

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-399	https://jvndb.jvn.jp/ja/cwe/CWE-399.html

ベンダー情報

No	Name	URL
GNU C Library
1	Top Page	http://www.gnu.org/software/libc/libc.html

その他

No	Name	URL
JVN
1	JVNVU#912279	http://jvn.jp/cert/JVNVU912279
Secunia Advisory
2	SA42547	http://secunia.com/advisories/42547
SecurityFocus
3	45233	http://www.securityfocus.com/bid/45233
SecurityTracker
4	1024832	http://securitytracker.com/id?1024832
US-CERT Vulnerability Note
5	VU#912279	http://www.kb.cert.org/vuls/id/912279

Change Log

No	Changed Details	Date of change
0	[2011年01月21日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-4052

Summary	Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Publication Date	Jan. 14, 2011, 4 a.m.
Registration Date	Jan. 29, 2021, 11:07 a.m.
Last Update	Nov. 21, 2024, 10:20 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://cxib.net/stuff/proftpd.gnu.c	Patch
2	http://cxib.net/stuff/proftpd.gnu.c	Patch
3	http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
4	http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
5	http://secunia.com/advisories/42547	Vendor Advisory
6	http://secunia.com/advisories/42547	Vendor Advisory
7	http://securityreason.com/achievement_securityalert/93	Exploit
8	http://securityreason.com/achievement_securityalert/93	Exploit
9	http://securityreason.com/securityalert/8003	Exploit
10	http://securityreason.com/securityalert/8003	Exploit
11	http://securitytracker.com/id?1024832
12	http://securitytracker.com/id?1024832
13	http://www.exploit-db.com/exploits/15935
14	http://www.exploit-db.com/exploits/15935
15	http://www.kb.cert.org/vuls/id/912279	US Government Resource
16	http://www.kb.cert.org/vuls/id/912279	US Government Resource
17	http://www.securityfocus.com/archive/1/515589/100/0/threaded
18	http://www.securityfocus.com/archive/1/515589/100/0/threaded
19	http://www.securityfocus.com/bid/45233	Exploit
20	http://www.securityfocus.com/bid/45233	Exploit
21	https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit
22	https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-399	リソース管理の問題	https://cwe.mitre.org/data/definitions/399.html