Bug 1199525 (CVE-2015-1781) - CVE-2015-1781 glibc: buffer overflow in gethostbyname_r() and related functions with misaligned buffer
Summary: CVE-2015-1781 glibc: buffer overflow in gethostbyname_r() and related functio...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-1781
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1209107 1209375 1209376 1214152 1214154
Blocks: 1199526 1210268 1262918
TreeView+ depends on / blocked
 
Reported: 2015-03-06 14:55 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:33 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A buffer overflow flaw was found in the way glibc's gethostbyname_r() and other related functions computed the size of a buffer when passed a misaligned buffer as input. An attacker able to make an application call any of these functions with a misaligned buffer could use this flaw to crash the application or, potentially, execute arbitrary code with the permissions of the user running the application.
Clone Of:
Environment:
Last Closed: 2015-11-20 05:52:59 UTC

Attachments (Terms of Use)
resolver.patch (957 bytes, patch)
2015-03-09 10:58 UTC, Florian Weimer 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0863 0 normal SHIPPED_LIVE Moderate: glibc security and bug fix update 2015-04-21 15:34:41 UTC
Red Hat Product Errata RHSA-2015:2199 0 normal SHIPPED_LIVE Moderate: glibc security, bug fix, and enhancement update 2015-11-19 08:04:22 UTC
Red Hat Product Errata RHSA-2015:2589 0 normal SHIPPED_LIVE Important: glibc security update 2015-12-09 13:57:25 UTC
Sourceware 18287 0 P2 RESOLVED Buffer overflow in getanswer_r, resolv/nss_dns/dns-host.c (CVE-2015-1781) 2020-01-08 03:01:20 UTC

Description Vasyl Kaigorodov 2015-03-06 14:55:29 UTC 
Arjun Shankar of Red Hat discovered that gethostbyname_r and related functions compute the size of an input buffer incorrectly if the passed-in buffer is misaligned. This results in a buffer overflow.
Comment 3 Florian Weimer 2015-03-09 10:58:11 UTC 
Created attachment 999499 [details]
resolver.patch

Arjun's patch.
Comment 15 Martin Prpič 2015-04-20 08:03:35 UTC 
Acknowledgements:

This issue was discovered by Arjun Shankar of Red Hat.
Comment 18 errata-xmlrpc 2015-04-21 11:35:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:0863 https://rhn.redhat.com/errata/RHSA-2015-0863.html
Comment 20 Florian Weimer 2015-04-22 06:15:03 UTC 
Created glibc tracking bugs for this issue:

Affects: fedora-all [bug 1214152]
Comment 21 Huzaifa S. Sidhpurwala 2015-07-17 05:45:23 UTC 
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Comment 22 errata-xmlrpc 2015-11-19 04:17:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2199 https://rhn.redhat.com/errata/RHSA-2015-2199.html
Comment 23 errata-xmlrpc 2015-12-09 08:58:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.1 EUS - Server and Compute Node Only
  Red Hat Enterprise Linux 7.1 EUS  - Server and Compute Node Only

Via RHSA-2015:2589 https://rhn.redhat.com/errata/RHSA-2015-2589.html
Comment 24 Fedora Update System 2016-02-17 12:49:36 UTC 
glibc-2.21-11.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.