CVE-2017-1000366

高 7.8CVE-2017-1000366 · 19/06/2017 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
glibc gnu	`≤ 2.25`	修正版なし
web gateway mcafee	`≥ 7.7.0.0, ≤ 7.7.2.2≤ 7.6.2.14`	修正版なし
cloud magnum orchestration openstack	`= 7`	修正版なし

概要

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

参考情報

packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
seclists.org/fulldisclosure/2019/Sep/7
debian.org/security/2017/dsa-3887 · Third Party Advisory
securityfocus.com/bid/99127 · Third Party Advisory
securitytracker.com/id/1038712 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1479 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1480 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1481 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1567 · Third Party Advisory
access.redhat.com/errata/RHSA-2017:1712 · Third Party Advisory
access.redhat.com/security/cve/CVE-2017-1000366 · Third Party Advisory
kc.mcafee.com/corporate/index · Patch
seclists.org/bugtraq/2019/Sep/7
security.gentoo.org/glsa/201706-19 · Third Party Advisory
exploit-db.com/exploits/42274 · Third Party Advisory
exploit-db.com/exploits/42275 · Third Party Advisory
exploit-db.com/exploits/42276 · Third Party Advisory
qualys.com/2017/06/19/stack-clash/stack-clash.txt · Technical Description
suse.com/security/cve/CVE-2017-1000366 · Third Party Advisory
suse.com/support/kb/doc · Third Party Advisory

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン