CVE-2015-7547
published 2016-02-18CVE-2015-7547: Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before…
PriorityP187high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
90.99%
99.8th percentile
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | glibc | < glibc 2.21-8 (bookworm) | glibc 2.21-8 (bookworm) |
| f5 | big-ip_access_policy_manager | — | — |
| f5 | big-ip_advanced_firewall_manager | — | — |
| f5 | big-ip_analytics | — | — |
| f5 | big-ip_application_acceleration_manager | — | — |
| f5 | big-ip_application_security_manager | — | — |
| f5 | big-ip_domain_name_system | — | — |
| f5 | big-ip_link_controller | — | — |
| f5 | big-ip_local_traffic_manager | — | — |
| f5 | big-ip_policy_enforcement_manager | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
| gnu | glibc | — | — |
Detection & IOCsextracted from sources · hover to see the quote
command\x48\x31\xff\x57\x57\x5e\x5a\x48\xbf\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x48\xc1\xef\x08\x57\x54\x5f\x6a\x3b\x58\x0f\x05↗
bytes↗
\x90 * 1955 (NOP sled) followed by /bin/sh shellcode
bytes↗
DNS flags 0x8380 (response with truncated bit set)
- →Detect oversized DNS responses (>2048 bytes) triggering TCP fallback (truncated bit set in UDP response followed by TCP DNS query to same server) — characteristic of CVE-2015-7547 exploitation attempt. ↗
- →Monitor for dual A/AAAA DNS queries (AF_UNSPEC or AF_INET6) to the same hostname that receive anomalously large responses (>2048 bytes), especially with the truncated flag set in UDP forcing TCP retry. ↗
- →In exploit PoC, the malicious DNS server sends a UDP response with truncated flag (0x8380) and a padding of 2500 null bytes to force malloc, then delivers the overflow payload over TCP — alert on DNS UDP responses with TC=1 and anomalous padding. ↗
- →Alert on DNS TCP responses containing large NOP sleds (0x90 repeated hundreds/thousands of times) followed by x86-64 execve /bin/sh shellcode bytes. ↗
- →The exploit requires the attacker to control the DNS server configured on the victim. Detect DNS resolution directed at untrusted/external DNS servers not in the approved resolver list, especially for privileged processes (sshd, sudo, curl, apache). ↗
- →Monitor for DNS responses with an unusually high answer count (PoC uses 184 answers) in a single response, which is anomalous and indicative of exploitation. ↗
- ·Exploitation requires the attacker to control the DNS server configured on the target device; the vulnerability is not exploitable via arbitrary network positions without DNS server control. ↗
- ·Additional anti-exploitation mitigations such as ASLR must be overcome for successful code execution; crash/DoS is more reliably achievable. ↗
- ·The PoC server code will crash any client on the same system that calls getaddrinfo() while testing is underway, not just the intended target process. ↗
- ·RedHat-listed mitigations (e.g., DNS response size limits) have the potential to interfere with normal DNS operations and should only be applied if DNS usage is well understood. ↗
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vulncheck8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5xr7-h7cp-w9pc: Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6)
ghsa_unreviewed·2022-05-13
CVE-2015-7547 [HIGH] CWE-119 GHSA-5xr7-h7cp-w9pc: Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6)
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
OSV
CVE-2015-7547: Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6)
osv·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] CVE-2015-7547: Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6)
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
VulnCheck
debian debian_linux Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2015·CVSS 8.1
CVE-2015-7547 [HIGH] debian debian_linux Improper Restriction of Operations within the Bounds of a Memory Buffer
debian debian_linux Improper Restriction of Operations within the Bounds of a Memory Buffer
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Affected: debian debian_linux
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dl.acm.org/doi/pdf/10
Palo Alto
Glibc DNS Resolver Vulnerability
vendor_paloalto·2016-08-15·CVSS 8.1
CVE-2015-7547 [HIGH] CWE-119 Glibc DNS Resolver Vulnerability
Glibc DNS Resolver Vulnerability
A vulnerability in the GNU libc (glibc) DNS resolver allows remote code execution (CVE-2015-7547). However, this issue can be exploited only from a DNS server that is under the control of an attacker. (Ref # 91886).
This glibc issue is only exploitable by an attacker controlling the DNS server configured for the device. Furthermore, the attacker must overcome additional anti-exploitation mitigations, such as ASLR, to mount a successful attack.
This issue affects PAN-OS 5.0.19 and earlier; PAN-OS 5.1.12 and earlier; PAN-OS 6.0.14 and earlier; PAN-OS 6.1.12 and earlier; PAN-OS 7.0.7 and earlier; PAN-OS 7.1.3 and earlier
Affected products: PAN-OS
Solution: PAN-OS 5.0.20 and later; PAN-OS 5.1.13 and later; PAN-OS 6.0.15 and later; PAN-OS 6.1.13 and later; PA
CISA ICS
Siemens Industrial Products glibc Library Vulnerability (Update C)
cisa_ics·2016-07-14
Siemens Industrial Products glibc Library Vulnerability (Update C)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens Industrial Products glibc Library Vulnerability (Update C)
Last RevisedAugust 23, 2018
Alert CodeICSA-16-103-01C
## OVERVIEW
This updated advisory is a follow-up to the advisory update titled ICSA-16-103-01B Siemens Industrial Products glibc Library Vulnerability that was published July 14, 2016, on the NCCIC/ICS-CERT web site.
Siemens reports that a buffer overflow vulnerability in the glibc library could affect several of its industrial products.
## --------- Begin Update C Part 1 of 3 --------
Siemens has produced updates to mitigate this vulnerability in ROX II, A
Cisco
Vulnerability in GNU glibc Affecting Cisco Products: February 2016
vendor_cisco·2016-02-19
CVE-2015-7547 [HIGH] CWE-119 Vulnerability in GNU glibc Affecting Cisco Products: February 2016
Vulnerability in GNU glibc Affecting Cisco Products: February 2016
On February 16, 2016, an industry-wide, critical vulnerability in the GNU C library (glibc) was publicly disclosed.
Multiple Cisco products incorporate a version of glibc that may be affected by the vulnerability. The vulnerability could allow an unauthenticated, remote attacker to trigger a buffer overflow condition that may result in a denial of service (DoS) condition or allow the attacker to execute arbitrary code on an affected device.
Cisco will release software updates that address this vulnerability.
Workarounds that address this vulnerability are not available.
This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-glibc
Ubuntu
GNU C Library vulnerability
vendor_ubuntu·2016-02-16
CVE-2015-7547 GNU C Library vulnerability
Title: GNU C Library vulnerability
Summary: GNU C Library could be made to crash or run programs if it received
specially crafted network traffic.
It was discovered that the GNU C Library incorrectly handled receiving
responses while performing DNS resolution. A remote attacker could use this
issue to cause the GNU C Library to crash, resulting in a denial of
service, or possibly execute arbitrary code.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
glibc: getaddrinfo stack-based buffer overflow
vendor_redhat·2016-02-16·CVSS 8.1
CVE-2015-7547 [HIGH] CWE-121 glibc: getaddrinfo stack-based buffer overflow
glibc: getaddrinfo stack-based buffer overflow
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
A stack-based buffer overflow was found in the way the libresolv library performed dual A/AAAA DNS queries. A remote attacker could create a specially crafted DNS response which could cause libresolv to crash or, potentially, execute code with the permissions of the user running the lib
Debian
CVE-2015-7547: glibc - Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functio...
vendor_debian·2015·CVSS 8.1
CVE-2015-7547 [HIGH] CVE-2015-7547: glibc - Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functio...
Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS response that triggers a call to the getaddrinfo function with the AF_UNSPEC or AF_INET6 address family, related to performing "dual A/AAAA DNS queries" and the libnss_dns.so.2 NSS module.
Scope: local
bookworm: resolved (fixed in 2.21-8)
bullseye: resolved (fixed in 2.21-8)
forky: resolved (fixed in 2.21-8)
sid: resolved (fixed in 2.21-8)
trixie: resolved (fixed in 2.21-8)
Cisco
Vulnerability in GNU glibc Affecting Cisco Products: February 2016
vendor_cisco
CVE-2015-7547 Vulnerability in GNU glibc Affecting Cisco Products: February 2016
CVE-2015-7547: Vulnerability in GNU glibc Affecting Cisco Products: February 2016
On February 16, 2016, an industry-wide, critical vulnerability in the GNU C library ( glibc ) was publicly disclosed. Multiple Cisco products incorporate a version of glibc that may be affected by the vulnerability. The vulnerability could allow an unauthenticated, remote attacker to trigger a buffer overflow condition that may result in a denial of service (DoS) condition or allow the attacker to execute arbitrary code on an affected device. Cisco will release software updates that address this vulnerability.
CWE: CWE-119, CWE-119
Bug IDs: CSCuy32284, CSCuy34700, CSCuy34875, CSCuy32284, CSCuy34700
Suricata
ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup
ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup
Rule: alert udp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2015-7547 Long Response to A lookup"; flow:from_server; content:"|00 01|"; offset:4; depth:2; isdataat:2049; byte_test:1,&,128,2; byte_test:1,!&,64,2; byte_test:1,!&,32,2; byte_test:1,!&,16,2; byte_test:1,!&,8,2; byte_test:1,&,2,2; byte_test:1,!&,1,3; byte_test:1,!&,2,3; byte_test:1,!&,4,3; byte_test:1,!&,8,3; pcre:"/^.{6}[^\x00]+/Rs"; content:"|00 00 01 00 01|"; within:5; reference:cve,2015-7547; classtype:attempted-user; sid:2022543; rev:1; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2015-7547 Malformed Server Response A/AAAA
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 Malformed Server Response A/AAAA
ET EXPLOIT Possible CVE-2015-7547 Malformed Server Response A/AAAA
Rule: alert udp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2015-7547 Malformed Server Response A/AAAA"; flow:from_server; content:"|00 01 00 00 00 00 00 00|"; offset:4; depth:10; isdataat:2049; byte_test:1,&,128,2; byte_test:1,!&,64,2; byte_test:1,!&,32,2; byte_test:1,!&,16,2; byte_test:1,!&,8,2; byte_test:1,&,2,2; byte_test:1,!&,1,3; byte_test:1,!&,2,3; byte_test:1,!&,4,3; byte_test:1,!&,8,3; pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri"; reference:cve,2015-7547; classtype:attempted-user; sid:2022545; rev:1; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible 2015-7547 PoC Server Response
suricata·2016-02-18
CVE-2015-7547 ET EXPLOIT Possible 2015-7547 PoC Server Response
ET EXPLOIT Possible 2015-7547 PoC Server Response
Rule: alert udp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible 2015-7547 PoC Server Response"; flow:from_server; content:"|83 80 00 01 00 00 00 00 00 00|"; offset:2; depth:10; isdataat:2049; pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri"; reference:cve,2015-7547; classtype:attempted-user; sid:2022542; rev:1; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)
Rule: alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET EXPLOIT Possible CVE-2015-7547 A/AAAA Record Lookup Possible Forced FallBack(fb set)"; flow:established,to_server; flowbits:set,ET.CVE20157547.primer; flowbits:noalert; byte_test:2,<,513,0; byte_test:1,!&,128,4; byte_test:1,!&,64,4; byte_test:1,!&,32,4; byte_test:1,!&,16,4; byte_test:1,!&,8,4; content:"|00 01 00 00 00 00 00 00|"; offset:6; depth:8; pcre:"/^(?:.[a-z0-9-]{2,}){2,}\x00\x00(?:\x01|\x1c)/Ri"; reference:cve,2015-7547; classtype:attempted-user; sid:2022546; rev:2; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2024_03_14;)
Suricata
ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup
ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup
Rule: alert udp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2015-7547 Long Response to AAAA lookup"; flow:from_server; content:"|00 01|"; offset:4; depth:2; isdataat:2049; byte_test:1,&,128,2; byte_test:1,!&,64,2; byte_test:1,!&,32,2; byte_test:1,!&,16,2; byte_test:1,!&,8,2; byte_test:1,&,2,2; byte_test:1,!&,1,3; byte_test:1,!&,2,3; byte_test:1,!&,4,3; byte_test:1,!&,8,3; pcre:"/^.{6}[^\x00]+/Rs"; content:"|00 00 1c 00 01|"; within:5; reference:cve,2015-7547; classtype:attempted-user; sid:2022544; rev:1; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Suricata
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
suricata·2016-02-18·CVSS 8.1
CVE-2015-7547 [HIGH] ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query
Rule: alert tcp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query"; flow:established,to_client; flowbits:isset,ET.CVE20157547.primer; byte_test:2,>,2048,0; byte_test:1,&,128,4; byte_test:1,!&,64,4; byte_test:1,!&,32,4; byte_test:1,!&,16,4; byte_test:1,!&,8,4; content:"|00 01|"; offset:6; depth:2; reference:cve,2015-7547; classtype:attempted-user; sid:2022547; rev:2; metadata:created_at 2016_02_18, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2024_03_07;)
Suricata
ET EXPLOIT Possible 2015-7547 Malformed Server response
suricata·2016-02-17
CVE-2015-7547 ET EXPLOIT Possible 2015-7547 Malformed Server response
ET EXPLOIT Possible 2015-7547 Malformed Server response
Rule: alert udp any 53 -> $HOME_NET any (msg:"ET EXPLOIT Possible 2015-7547 Malformed Server response"; flow:from_server; content:"|00 01 00 00 00 00 00 00|"; offset:4; depth:8; isdataat:2049; byte_test:1,&,128,2; byte_test:1,!&,64,2; byte_test:1,!&,32,2; byte_test:1,!&,16,2; byte_test:1,!&,8,2; byte_test:1,&,2,2; byte_test:1,!&,1,3; byte_test:1,!&,2,3; byte_test:1,!&,4,3; byte_test:1,!&,8,3; pcre:"/^[^\x00]+\x00\x00\x01/R"; reference:cve,2015-7547; classtype:attempted-user; sid:2022531; rev:1; metadata:created_at 2016_02_17, cve CVE_2015_7547, confidence Medium, signature_severity Major, updated_at 2019_07_26;)
Exploit-DB
glibc - 'getaddrinfo' Remote Stack Buffer Overflow
exploitdb·2016-09-06·CVSS 8.1
CVE-2015-7547 [HIGH] glibc - 'getaddrinfo' Remote Stack Buffer Overflow
glibc - 'getaddrinfo' Remote Stack Buffer Overflow
---
/*
add by SpeeDr00t@Blackfalcon (jang kyoung chip)
This is a published vulnerability by google in the past.
Please refer to the link below.
Reference:
- https://googleonlinesecurity.blogspot.kr/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
- https://github.com/fjserna/CVE-2015-7547
- CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow
When Google announced about this code(vulnerability),
it was missing information on shellcode.
So, I tried to completed the shellcode.
In the future, I hope to help your study.
(gdb) r
Starting program: /home/haker/client1
Got object file from memory but can't read symbols: File truncated.
[UDP] Total Data len recv 36
[UDP] Total Data len recv 36
udp send
sendto 1
TCP Connected with
Exploit-DB
glibc - 'getaddrinfo' Stack Buffer Overflow (PoC)
exploitdb·2016-02-16·CVSS 8.1
CVE-2015-7547 [HIGH] glibc - 'getaddrinfo' Stack Buffer Overflow (PoC)
glibc - 'getaddrinfo' Stack Buffer Overflow (PoC)
---
Sources:
https://googleonlinesecurity.blogspot.sg/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.html
https://github.com/fjserna/CVE-2015-7547
Technical information:
glibc reserves 2048 bytes in the stack through alloca() for the DNS answer at _nss_dns_gethostbyname4_r() for hosting responses to a DNS query.
Later on, at send_dg() and send_vc(), if the response is larger than 2048 bytes, a new buffer is allocated from the heap and all the information (buffer pointer, new buffer size and response size) is updated.
Under certain conditions a mismatch between the stack buffer and the new heap allocation will happen. The final effect is that the stack buffer will be used to store the DNS response, even though the response is larger tha
Bugzilla
CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow [fedora-all]
bugzilla·2016-02-16·CVSS 8.1
CVE-2015-7547 [HIGH] CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow [fedora-all]
CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedo
Bugzilla
CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow
bugzilla·2015-12-22·CVSS 8.1
CVE-2015-7547 [HIGH] CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow
CVE-2015-7547 glibc: getaddrinfo stack-based buffer overflow
A stack-based buffer overflow was found in libresolv when invoked from nss_dns, allowing specially crafted DNS responses to seize control of EIP in the DNS client.
The buffer overflow occurs in the functions send_dg (send datagram) and send_vc (send TCP) for the NSS module libnss_dns.so.2 when calling getaddrinfo with AF_UNSPEC family, or in some cases AF_INET6 family. The use of AF_UNSPEC (or AF_INET6 in some cases) triggers the low-level resolver code to send out two parallel queries for A and AAAA. A mismanagement of the buffers used for those queries could result in the response of a query writing beyond the alloca allocated buffer created by __res_nquery.
Discussion:
Acknowledgements:
This issue was discovered by the Go
Qualys
New critical glibc vulnerability | Qualys
blogs_qualys·2016-02-22·CVSS 8.1
CVE-2015-7547 [HIGH] New critical glibc vulnerability | Qualys
Last week, Fermin Serna from Google posted a report of a critical vulnerability in the glibc library used in very fundamental level in almost all Linux systems. The vulnerability CVE-2015-7547 is in the getaddrinfo() function and can be used to gain Remote Code Execution.
A malicious DNS server provides an overlong, specially formatted answer to a normal address query, which overflows a statically allocated internal 2K buffer with data. The data is then executed within the getaddrinfo() function.
Google published a PoC to illustrate the problem and mentioned a couple of attack vectors – SSH which originally tipped them off for example, but made it clear that many other vector exist. This makes sense since almost all programs include glibc and many will end up using the getaddrinfo() func
Qualys
New critical glibc vulnerability | Qualys
blogs_qualys·2016-02-22·CVSS 8.1
CVE-2015-7547 [HIGH] New critical glibc vulnerability | Qualys
Last week, Fermin Serna from Google posted a report of a critical vulnerability in the glibc library used in very fundamental level in almost all Linux systems. The vulnerability CVE-2015-7547 is in the getaddrinfo() function and can be used to gain Remote Code Execution.
A malicious DNS server provides an overlong, specially formatted answer to a normal address query, which overflows a statically allocated internal 2K buffer with data. The data is then executed within the getaddrinfo() function.
Google published a PoC to illustrate the problem and mentioned a couple of attack vectors – SSH which originally tipped them off for example, but made it clear that many other vector exist. This makes sense since almost all programs include glibc and many will end up using the getaddrinfo() func
http://fortiguard.com/advisory/glibc-getaddrinfo-stack-overflowhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177412.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00044.htmlhttp://marc.info/?l=bugtraq&m=145596041017029&w=2http://marc.info/?l=bugtraq&m=145672440608228&w=2http://marc.info/?l=bugtraq&m=145690841819314&w=2http://marc.info/?l=bugtraq&m=145857691004892&w=2http://marc.info/?l=bugtraq&m=146161017210491&w=2http://packetstormsecurity.com/files/135802/glibc-getaddrinfo-Stack-Based-Buffer-Overflow.htmlhttp://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlhttp://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.htmlhttp://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0175.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0176.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0225.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0277.htmlhttp://seclists.org/fulldisclosure/2019/Sep/7http://seclists.org/fulldisclosure/2021/Sep/0http://seclists.org/fulldisclosure/2022/Jun/36http://support.citrix.com/article/CTX206991http://ubuntu.com/usn/usn-2900-1http://www.debian.org/security/2016/dsa-3480http://www.debian.org/security/2016/dsa-3481http://www.fortiguard.com/advisory/glibc-getaddrinfo-stack-overflowhttp://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160304-01-glibc-enhttp://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/83265http://www.securitytracker.com/id/1035020http://www.vmware.com/security/advisories/VMSA-2016-0002.htmlhttps://access.redhat.com/articles/2161461https://blogs.sophos.com/2016/02/24/utm-up2date-9-355-released/https://blogs.sophos.com/2016/02/29/utm-up2date-9-319-released/https://bto.bluecoat.com/security-advisory/sa114https://bugzilla.redhat.com/show_bug.cgi?id=1293532https://googleonlinesecurity.blogspot.com/2016/02/cve-2015-7547-glibc-getaddrinfo-stack.htmlhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05028479https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04989404https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05008367https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05053211https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05073516https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05098877https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05125672https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05128937https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05130958https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05140858https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05158380https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05176716https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05212266https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05376917https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixeshttps://ics-cert.us-cert.gov/advisories/ICSA-16-103-01https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40161https://kc.mcafee.com/corporate/index?page=content&id=SB10150https://seclists.org/bugtraq/2019/Sep/7https://security.gentoo.org/glsa/201602-02https://security.netapp.com/advisory/ntap-20160217-0002/https://sourceware.org/bugzilla/show_bug.cgi?id=18665https://sourceware.org/ml/libc-alpha/2016-02/msg00416.htmlhttps://support.f5.com/kb/en-us/solutions/public/k/47/sol47098834.htmlhttps://support.lenovo.com/us/en/product_security/len_5450https://www.arista.com/en/support/advisories-notices/security-advisories/1255-security-advisory-17https://www.exploit-db.com/exploits/39454/https://www.exploit-db.com/exploits/40339/https://www.kb.cert.org/vuls/id/457759https://www.tenable.com/security/research/tra-2017-08http://fortiguard.com/advisory/glibc-getaddrinfo-stack-overflowhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177404.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2016-February/177412.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00037.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00038.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00039.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00043.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00044.htmlhttp://marc.info/?l=bugtraq&m=145596041017029&w=2http://marc.info/?l=bugtraq&m=145672440608228&w=2http://marc.info/?l=bugtraq&m=145690841819314&w=2http://marc.info/?l=bugtraq&m=145857691004892&w=2http://marc.info/?l=bugtraq&m=146161017210491&w=2http://packetstormsecurity.com/files/135802/glibc-getaddrinfo-Stack-Based-Buffer-Overflow.htmlhttp://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.htmlhttp://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.htmlhttp://packetstormsecurity.com/files/167552/Nexans-FTTO-GigaSwitch-Outdated-Components-Hardcoded-Backdoor.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0175.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0176.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0225.htmlhttp://rhn.redhat.com/errata/RHSA-2016-0277.htmlhttp://seclists.org/fulldisclosure/2019/Sep/7http://seclists.org/fulldisclosure/2021/Sep/0
+ 50 more references
2016-02-18
Published
Exploited in the wild