glibc Library - Stack-Based Buffer Overflow Vulnerability

Number: AV16-031
Date: 18 February 2016

Purpose

The purpose of this advisory is to bring attention to a vulnerability VulnerabilityA flaw or weakness in the design or implementation of an information system or its environment that could be exploited to adversely affect an organization's assets or operations. discovered in the glibc library of code, a key component of most Linux distributions.

Assessment

GNU C Library (glibc) is a collection of open source code that powers standalone applications and most Linux distributions.

The vulnerability in glibc relates to a stack-based buffer overflow in the glibc DNS client-side resolver that puts Linux machines at risk for remote code execution. The flaw is triggered when the getaddrinfo() library function, which is responsible for performing domain-name lookups, is used.

Affected Software: All versions of glibc Version 2.9 to 2.22 are vulnerable.

CVE Reference: CVE-2015-7547