A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.
Una vulnerabilidad de uso de la memoria previamente liberada introducida en glibc versiones anteriores a la versión 2.14, se descubrió en la manera en que se llevó a cabo la expansión de tilde. Las rutas de directorios que contenían una tilde inicial seguida de un nombre de usuario válido estaban afectadas por este problema. Un atacante local podría explotar este fallo creando una ruta especialmente diseñada que, al ser procesada por la función glob, podría conllevar a una ejecución de código arbitraria. Esto fue corregido en la versión 2.32.
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:H/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | HIGH |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-416
|
| [email protected] | Secondary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | glibc | * | <built-in method update of dict object at 0x7fd34011ce40> | Application |
| canonical | ubuntu_linux | 16.04 | <built-in method update of dict object at 0x7fd34011fe40> | Operating System |
| canonical | ubuntu_linux | 18.04 | <built-in method update of dict object at 0x7fd340f0ef80> | Operating System |
| canonical | ubuntu_linux | 19.10 | <built-in method update of dict object at 0x7fd34011ca40> | Operating System |
| netapp | active_iq_unified_manager | * | <built-in method update of dict object at 0x7fd34011d000> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd34011fa80> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd34011e1c0> | Application |
| netapp | steelstore_cloud_integrated_storage | - | <built-in method update of dict object at 0x7fd34011ee00> | Application |
| netapp | h410c_firmware | - | <built-in method update of dict object at 0x7fd34011f0c0> | Operating System |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd34011d040> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* |
| Yes | cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |