The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.
La función de compatibilidad obsoleta clnt_create en el módulo sunrpc de la Biblioteca C de GNU (también se conoce como glibc) versiones hasta 2.34, copia su argumento de nombre de host en la pila sin comprobar su longitud, que puede resultar en un desbordamiento de búfer, resultando potencialmente en una denegación de servicio o (si una aplicación no está construida con un protector de pila habilitado) la ejecución de código arbitrario
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:N/AC:L/Au:N/C:P/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-120
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-120
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| gnu | glibc | * | <built-in method update of dict object at 0x7fd37018d000> | Application |
| oracle | communications_cloud_native_core_binding_support_function | 22.1.3 | <built-in method update of dict object at 0x7fd368d9bdc0> | Application |
| oracle | communications_cloud_native_core_network_function_cloud_native_environment | 22.1.0 | <built-in method update of dict object at 0x7fd3081a7fc0> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.1.2 | <built-in method update of dict object at 0x7fd36b8fc600> | Application |
| oracle | communications_cloud_native_core_network_repository_function | 22.2.0 | <built-in method update of dict object at 0x7fd37018f100> | Application |
| oracle | communications_cloud_native_core_security_edge_protection_proxy | 22.1.1 | <built-in method update of dict object at 0x7fd3081a5640> | Application |
| oracle | communications_cloud_native_core_unified_data_repository | 22.2.0 | <built-in method update of dict object at 0x7fd3081a5a80> | Application |
| oracle | enterprise_operations_monitor | 4.3 | <built-in method update of dict object at 0x7fd36b8fc100> | Application |
| oracle | enterprise_operations_monitor | 4.4 | <built-in method update of dict object at 0x7fd3855576c0> | Application |
| oracle | enterprise_operations_monitor | 5.0 | <built-in method update of dict object at 0x7fd3081a4900> | Application |
| debian | debian_linux | 10.0 | <built-in method update of dict object at 0x7fd3081a7840> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:gnu:glibc:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:22.1.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:22.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.1.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:22.1.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:22.2.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:4.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:4.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_operations_monitor:5.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |