CVE-2010-4052
published 2011-01-13CVE-2010-4052: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows…
PriorityP344medium5CVSS 2.0
AVNACLAuNCNINAP
EXPLOIT
EPSS
51.30%
98.8th percentile
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Affected
33 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | glibc | < glibc 2.19-4 (bookworm) | glibc 2.19-4 (bookworm) |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandstat {a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}{a,b}↗
- →Detect FTP STAT commands containing repeated brace-expansion wildcard patterns (e.g., {a,b} repeated 48+ times) sent by anonymous users, which trigger CPU exhaustion in ftpd via glob(3). ↗
- →Monitor for creation of a .ftpaccess file via FTP STOR containing HideFiles directives with nested quantifier regex patterns such as {10,}{10,}{10,}{10,} or adjacent '+' operators, which exploit regcomp() in glibc. ↗
- →Alert on proftpd child processes consuming 100% CPU for extended periods (600+ minutes), which is a runtime indicator of successful CVE-2010-4052 exploitation. ↗
- →Detect regcomp() calls with regex patterns containing adjacent repetition operators (e.g., {10,}{10,}{10,}{10,}) passed from untrusted input, particularly in network-facing daemons like proftpd or ftpd. ↗
- ·Red Hat assessed CVE-2010-4052 as not a security issue for RHEL 4/5/6, stating that applications using regcomp()/regexec() on untrusted input without sanity-checking are responsible for the limitation; no fix was planned. ↗
- ·The exploit requires write privileges to the FTP server to upload a malicious .ftpaccess file containing the HideFiles regex payload; without write access, only the direct STAT wildcard vector applies. ↗
- ·The amount of stack memory available to the glibc regex engine determines the size of input required to trigger the crash; environments with larger stack limits require longer/more complex patterns. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xq2p-cgwj-87m3: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2
ghsa_unreviewed·2022-05-14
CVE-2010-4052 [MEDIUM] GHSA-xq2p-cgwj-87m3: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
OSV
CVE-2010-4052: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2
osv·2011-01-13·CVSS 5.0
CVE-2010-4052 [MEDIUM] CVE-2010-4052: Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Red Hat
glibc: De-recursivise regular expression engine
vendor_redhat·2010-12-07·CVSS 5.0
CVE-2010-4052 [MEDIUM] glibc: De-recursivise regular expression engine
glibc: De-recursivise regular expression engine
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Statement: Red Hat does not consider crash of client application, using regcomp()
or regexec() routines on untrusted input without preliminary checking
the input for the sanity, to be a security issue (the described deficiency
implies and is a known limitation of the glibc regular expression engine
implementation). The expressions can be modified to avoid
Debian
CVE-2010-4052: glibc - Stack consumption vulnerability in the regcomp implementation in the GNU C Libra...
vendor_debian·2010·CVSS 5.0
CVE-2010-4052 [MEDIUM] CVE-2010-4052: glibc - Stack consumption vulnerability in the regcomp implementation in the GNU C Libra...
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.
Scope: local
bookworm: resolved (fixed in 2.19-4)
bullseye: resolved (fixed in 2.19-4)
forky: resolved (fixed in 2.19-4)
sid: resolved (fixed in 2.19-4)
trixie: resolved (fixed in 2.19-4)
No detection rules found.
Exploit-DB
FreeBSD 9.1 - 'ftpd' Remote Denial of Service
exploitdb·2013-02-05·CVSS 4.0
CVE-2011-0418 [MEDIUM] FreeBSD 9.1 - 'ftpd' Remote Denial of Service
FreeBSD 9.1 - 'ftpd' Remote Denial of Service
---
FreeBSD 9.1 ftpd Remote Denial of Service
Maksymilian Arciemowicz
http://cxsecurity.org/
http://cxsec.org/
Public Date: 01.02.2013
URL: http://cxsecurity.com/issue/WLB-2013020003
--- 1. Description ---
I have decided check BSD ftpd servers once again for wildcards. Old
bug in libc (CVE-2011-0418) allow to Denial of Service ftpd in last
FreeBSD version.
Attacker, what may connect anonymously to FTP server, may cause CPU
resource exhaustion. Login as a 'USER anonymous' 'PASS anonymous',
sending 'STAT' command with special wildchar, enought to create ftpd
process with 100% CPU usage.
Proof of Concept (POC):
See the difference between NetBSD/libc and FreeBSD/libc.
--- PoC ---
#include
#include
int main(){
glob_t globbuf;
char stringa[]="{
Exploit-DB
GNU libc/regcomp(3) - Multiple Vulnerabilities
exploitdb·2011-01-07·CVSS 5.0
CVE-2010-4051 [MEDIUM] GNU libc/regcomp(3) - Multiple Vulnerabilities
GNU libc/regcomp(3) - Multiple Vulnerabilities
---
// source: http://securityreason.com/securityalert/8003
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[ GNU libc/regcomp(3) Multiple Vulnerabilities ]
Author: Maksymilian Arciemowicz
http://securityreason.com/
http://cxib.net/
Date:
- - Dis.: 01.10.2010
- - Pub.: 07.01.2011
CERT: VU#912279
CVE:
CVE-2010-4051
CVE-2010-4052
Affected (tested):
- - Ubuntu 10.10
- - Slackware 13
- - Gentoo 18.10.2010
- - FreeBSD 8.1 (grep(1))
- - NetBSD 5.0.2 (grep(1))
Original URL:
http://securityreason.com/achievement_securityalert/93
Exploit for proftpd:
http://cxib.net/stuff/proftpd.gnu.c
- --- 0.Description ---
The GNU C library is used as the C library in the GNU system and most
systems with the Linux kernel.
# define RE_DUP_MAX (0x7fff)
regc
Exploit-DB
GNU glibc - 'regcomp()' Stack Exhaustion Denial of Service
exploitdb·2010-12-07·CVSS 5.0
CVE-2010-4052 [MEDIUM] GNU glibc - 'regcomp()' Stack Exhaustion Denial of Service
GNU glibc - 'regcomp()' Stack Exhaustion Denial of Service
---
// source: https://www.securityfocus.com/bid/45233/info
GNU glibc is prone to a denial-of-service vulnerability due to stack exhaustion.
Successful exploits will allow attackers to make the affected computer unresponsive, denying service to legitimate users.
This issue affects unknown versions of the glibc library. This BID will be updated when more details become available.
#include
#include
#include
#include
#include
#include
#include
/*
proftpd multiple exploit for VU#912279 (only with GNU libc/regcomp(3))
by Maksymilian Arciemowicz
References:
http://www.kb.cert.org/vuls/id/912279
http://cxib.net/
http://securityreason.com/
Tested:
Ubuntu + proftpd
This exploit need writing privileges to create .ftpaccess file wi
HackerOne
Container scanning and Dependency scanning report leaked to unauthorized users
hackerone·2019-12-13·CVSS 5.0
[MEDIUM] Container scanning and Dependency scanning report leaked to unauthorized users
Container scanning and Dependency scanning report leaked to unauthorized users
Hi GitLab Security team
### Summary
GitLab makes the container scanning and dependency scanning information available as part of a JSON endpoint for merge requests. These reports are output of the CI job and should only be displayed if the visiting user has access to CI. However, right now GitLab displays the the container scanning and dependency scanning reports regardless of this permission, making it available to whoever has access to the merge request.
For public projects, GitLab allows to restrict CI pipelines to project members only (public pipelines disabled). However, in this case, the merge request widget still renders the scanning reports result, which is the outcome of a CI pipeline.
### Steps to
Bugzilla
CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
bugzilla·2010-10-22·CVSS 5.0
CVE-2010-4051 [MEDIUM] CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
CVE-2010-4051 CVE-2010-4052 glibc: De-recursivise regular expression engine
Maksymilian Arciemowicz reported a deficiency in the way
glibc regular expression engine processed certain patterns.
A local attacker could use this flaw to cause a denial of
service (crash due stack overflow).
Note: The above described behavior is a limitation of glibc
regular expression engine. Regular expression matching
function is called recursively for certain types of patterns
(where subexpression using quantifier is nested inside of
another quantified expression), where long input can result
in deep recursion and exhaustion of all stack memory (i.e.
impact is limited to crash). Amount of stack memory available
to glibc regular expression engine influences the size of input
that must be provided to trigger
http://cxib.net/stuff/proftpd.gnu.chttp://seclists.org/fulldisclosure/2011/Jan/78http://secunia.com/advisories/42547http://securityreason.com/achievement_securityalert/93http://securityreason.com/securityalert/8003http://securitytracker.com/id?1024832http://www.exploit-db.com/exploits/15935http://www.kb.cert.org/vuls/id/912279http://www.securityfocus.com/archive/1/515589/100/0/threadedhttp://www.securityfocus.com/bid/45233https://bugzilla.redhat.com/show_bug.cgi?id=645859http://cxib.net/stuff/proftpd.gnu.chttp://seclists.org/fulldisclosure/2011/Jan/78http://secunia.com/advisories/42547http://securityreason.com/achievement_securityalert/93http://securityreason.com/securityalert/8003http://securitytracker.com/id?1024832http://www.exploit-db.com/exploits/15935http://www.kb.cert.org/vuls/id/912279http://www.securityfocus.com/archive/1/515589/100/0/threadedhttp://www.securityfocus.com/bid/45233https://bugzilla.redhat.com/show_bug.cgi?id=645859
2011-01-13
Published