製品・ソフトウェアに関する情報

JVN脆弱性詳細

GNU Binutils で使用される GNU libiberty における整数オーバーフローの脆弱性

Title	GNU Binutils で使用される GNU libiberty における整数オーバーフローの脆弱性
Summary	GNU Binutils で使用される GNU libiberty の include/objalloc.h の (1) objalloc.c 内の _objalloc_alloc 関数、および (2) objalloc_alloc マクロには、"length への CHUNK_HEADER_SIZE の追加" に関する処理に不備があるため、整数オーバーフローの脆弱性が存在します。
Possible impacts	第三者により、サービス運用妨害 (クラッシュ) 状態にされる可能性があります
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Aug. 29, 2012, midnight
Registration Date	Sept. 7, 2012, 3:23 p.m.
Last Update	Sept. 7, 2012, 3:23 p.m.

Affected System

GNU Project

GNU Binutils 2.22

GNU libiberty

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-3509	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3509
National Vulnerability Database (NVD)
2	CVE-2012-3509	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-3509

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
GCC Bugzilla
1	Bug 54411	http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411
GCC, the GNU Compiler Collection
2	[PATCH] PR other/54411: libiberty: objalloc_alloc integer overflows (CVE-2012-3509)	http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html
GNU Binutils
3	Top Page	http://www.gnu.org/software/binutils/

Change Log

No	Changed Details	Date of change
0	[2012年09月07日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-3509

Summary	Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.
Publication Date	Sept. 6, 2012, 8:55 a.m.
Registration Date	Jan. 28, 2021, 3 p.m.
Last Update	Nov. 21, 2024, 10:41 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::lts:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411	Issue Tracking
2	http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54411	Issue Tracking
3	http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html	Patch Vendor Advisory
4	http://gcc.gnu.org/ml/gcc-patches/2012-08/msg01986.html	Patch Vendor Advisory
5	http://security-tracker.debian.org/tracker/CVE-2012-3509	Issue Tracking Third Party Advisory
6	http://security-tracker.debian.org/tracker/CVE-2012-3509	Issue Tracking Third Party Advisory
7	http://www.mandriva.com/security/advisories?name=MDVSA-2015:029	Broken Link
8	http://www.mandriva.com/security/advisories?name=MDVSA-2015:029	Broken Link
9	http://www.openwall.com/lists/oss-security/2012/08/29/3	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2012/08/29/3	Mailing List Third Party Advisory
11	http://www.securityfocus.com/bid/55281	Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/55281	Third Party Advisory VDB Entry
13	http://www.ubuntu.com/usn/USN-2496-1	Third Party Advisory
14	http://www.ubuntu.com/usn/USN-2496-1	Third Party Advisory
15	https://exchange.xforce.ibmcloud.com/vulnerabilities/78135
16	https://exchange.xforce.ibmcloud.com/vulnerabilities/78135

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html