NVD Vulnerability Detail

CVE-2016-3706

Summary	Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
Publication Date	June 11, 2016, 12:59 a.m.
Registration Date	Jan. 26, 2021, 2:11 p.m.
Last Update	Nov. 21, 2024, 11:50 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.2:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:gnu:glibc::::::::					2.23

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/102073	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/102073	Third Party Advisory VDB Entry
7	http://www.securityfocus.com/bid/88440	Third Party Advisory VDB Entry
8	http://www.securityfocus.com/bid/88440	Third Party Advisory VDB Entry
9	http://www-01.ibm.com/support/docview.wss?uid=swg21995039	Third Party Advisory
10	http://www-01.ibm.com/support/docview.wss?uid=swg21995039	Third Party Advisory
11	https://source.android.com/security/bulletin/2017-12-01	Third Party Advisory
12	https://source.android.com/security/bulletin/2017-12-01	Third Party Advisory
13	https://sourceware.org/bugzilla/show_bug.cgi?id=20010	Issue Tracking
14	https://sourceware.org/bugzilla/show_bug.cgi?id=20010	Issue Tracking
15	https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9
16	https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

GNU C Library の sysdeps/posix/getaddrinfo.c の getaddrinfo 関数におけるスタックベースのバッファオーバーフローの脆弱性

Title	GNU C Library の sysdeps/posix/getaddrinfo.c の getaddrinfo 関数におけるスタックベースのバッファオーバーフローの脆弱性
Summary	GNU C Library (別名 glibc または libc6) の sysdeps/posix/getaddrinfo.c の getaddrinfo 関数には、スタックベースのバッファオーバーフローの脆弱性が存在します。本脆弱性は、CVE-2013-4458 に対する修正が不十分だったことによる脆弱性です。
Possible impacts	第三者により、hostent 変換に関する問題によって、サービス運用妨害 (クラッシュ) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 29, 2016, midnight
Registration Date	June 14, 2016, 12:23 p.m.
Last Update	June 14, 2016, 12:23 p.m.

Affected System

GNU Project

GNU C Library

openSUSE project

openSUSE 13.2

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-3706	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3706
National Vulnerability Database (NVD)
2	CVE-2016-3706	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3706
sourceware.org
3	CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion [BZ #20010]	https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=4ab2ab03d4351914ee53248dc5aef4a8c88ff8b9

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
opensuse-updates
1	openSUSE-SU-2016:1527	https://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html
Sourceware Bugzilla
2	Bug 20010	https://sourceware.org/bugzilla/show_bug.cgi?id=20010

Change Log

No	Changed Details	Date of change
0	[2016年06月14日] 掲載	Feb. 17, 2018, 10:37 a.m.