Vulnerability Name:

CVE-2011-1659 (CCN-66819)

Assigned:2010-08-05
Published:2010-08-05
Updated:2018-10-09
Summary:Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.1 Medium (REDHAT CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-189
Vulnerability Consequences:Denial of Service
References:Source: MISC
Type: Exploit
http://code.google.com/p/chromium/issues/detail?id=48733

Source: MITRE
Type: CNA
CVE-2011-1659

Source: CCN
Type: RHSA-2011-0412
Important: glibc security update

Source: CCN
Type: RHSA-2011-0413
Important: glibc security update

Source: CCN
Type: RHSA-2012-0125
Moderate: glibc security and bug fix update

Source: MISC
Type: Exploit
http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html

Source: CCN
Type: SA44353
GNU C Library fnmatch() Integer Overflow Denial of Service Vulnerability

Source: SECUNIA
Type: UNKNOWN
44353

Source: CCN
Type: SA46397
VMware ESX / ESXi Server Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
46397

Source: CCN
Type: SA53166
Avaya Communication Manager OpenSSL and glibc Vulnerabilities

Source: CONFIRM
Type: Exploit, Patch
http://sourceware.org/bugzilla/show_bug.cgi?id=12583

Source: CONFIRM
Type: Patch
http://sourceware.org/git/?p=glibc.git;a=commit;h=8126d90480fa3e0c5c5cd0d02cb1c93174b45485

Source: CCN
Type: GNU C Library Web page
GNC C Library - GNU Project - Free Software Foundation (FSF)

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2011:178

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2011:179

Source: BUGTRAQ
Type: UNKNOWN
20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

Source: CCN
Type: BID-64464
GNU glibc 'posix/fnmatch.c' Source File Denial of Service Vulnerability

Source: SECTRACK
Type: UNKNOWN
1025450

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2011-0012.html

Source: CCN
Type: Red Hat Bugzilla Bug 681054
(CVE-2011-1071, CVE-2011-1659) CVE-2011-1071 CVE-2011-1659 glibc: fnmatch() alloca()-based memory corruption flaw

Source: CONFIRM
Type: Exploit, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=681054

Source: CCN
Type: ASA-2012-155
glibc security and bug fix update (RHSA-2012-0125)

Source: XF
Type: UNKNOWN
gnuclibrary-fnmatch-dos(66819)

Source: XF
Type: UNKNOWN
gnuclibrary-fnmatch-dos(66819)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:glibc:1.00:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.01:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.02:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.03:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.04:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.05:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.06:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.07:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.08:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.09:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.09.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.7:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.8:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:*:*:*:*:*:*:*:* (Version <= 2.13)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 10:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 11:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 12:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:glibc:2.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.7:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.8:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.3.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.09:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.08:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.07:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.06:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.05:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.04:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.03:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.02:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.01:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.00:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:1.09.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.13:*:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:avaya:communication_manager:4.0:*:*:*:*:*:*:*
  • OR cpe:/a:avaya:communication_manager:5.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:6:*:workstation:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_hpc_node:6:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_eus:5.6.z::server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_long_life:5.6:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20111659
    V
    		CVE-2011-1659
    2017-09-27
    oval:org.mitre.oval:def:23373
    P
    		ELSA-2011:0413: glibc security update (Important)
    2014-07-21
    oval:org.mitre.oval:def:15237
    P
    		USN-1396-1 -- GNU C Library vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:23052
    P
    		ELSA-2011:0412: glibc security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:21873
    P
    		RHSA-2011:0412: glibc security update (Important)
    2014-02-24
    oval:org.mitre.oval:def:21331
    P
    		RHSA-2011:0413: glibc security update (Important)
    2014-02-24
    oval:org.mitre.oval:def:19899
    V
    		VMware ESX third party updates for Service Console packages glibc and dhcp
    2014-01-20
    oval:org.mitre.oval:def:20430
    V
    		VMware ESX third party updates for Service Console packages glibc and dhcp
    2014-01-20
    oval:com.redhat.rhsa:def:20120125
    P
    		RHSA-2012:0125: glibc security and bug fix update (Moderate)
    2012-02-13
    oval:com.redhat.rhsa:def:20110412
    P
    		RHSA-2011:0412: glibc security update (Important)
    2011-04-04
    oval:com.redhat.rhsa:def:20110413
    P
    		RHSA-2011:0413: glibc security update (Important)
    2011-04-04
    BACK
    gnu glibc 1.00
    gnu glibc 1.01
    gnu glibc 1.02
    gnu glibc 1.03
    gnu glibc 1.04
    gnu glibc 1.05
    gnu glibc 1.06
    gnu glibc 1.07
    gnu glibc 1.08
    gnu glibc 1.09
    gnu glibc 1.09.1
    gnu glibc 2.0
    gnu glibc 2.0.1
    gnu glibc 2.0.2
    gnu glibc 2.0.3
    gnu glibc 2.0.4
    gnu glibc 2.0.5
    gnu glibc 2.0.6
    gnu glibc 2.1
    gnu glibc 2.1.1
    gnu glibc 2.1.1.6
    gnu glibc 2.1.2
    gnu glibc 2.1.3
    gnu glibc 2.1.3.10
    gnu glibc 2.1.9
    gnu glibc 2.2
    gnu glibc 2.2.1
    gnu glibc 2.2.2
    gnu glibc 2.2.3
    gnu glibc 2.2.4
    gnu glibc 2.2.5
    gnu glibc 2.3
    gnu glibc 2.3.1
    gnu glibc 2.3.2
    gnu glibc 2.3.3
    gnu glibc 2.3.4
    gnu glibc 2.3.5
    gnu glibc 2.3.6
    gnu glibc 2.3.10
    gnu glibc 2.4
    gnu glibc 2.5
    gnu glibc 2.5.1
    gnu glibc 2.6
    gnu glibc 2.6.1
    gnu glibc 2.7
    gnu glibc 2.8
    gnu glibc 2.9
    gnu glibc 2.10
    gnu glibc 2.10.1
    gnu glibc 2.10.2
    gnu glibc 2.11
    gnu glibc 2.11.1
    gnu glibc 2.11.2
    gnu glibc 2.11.3
    gnu glibc 2.12.0
    gnu glibc 2.12.1
    gnu glibc 2.12.2
    gnu glibc *
    gnu glibc 2.2.5
    gnu glibc 2.2.1
    gnu glibc 2.0
    gnu glibc 2.0.1
    gnu glibc 2.0.2
    gnu glibc 2.0.3
    gnu glibc 2.0.4
    gnu glibc 2.0.5
    gnu glibc 2.0.6
    gnu glibc 2.1
    gnu glibc 2.1.1
    gnu glibc 2.1.1.6
    gnu glibc 2.1.2
    gnu glibc 2.1.3
    gnu glibc 2.1.9
    gnu glibc 2.2
    gnu glibc 2.2.2
    gnu glibc 2.2.3
    gnu glibc 2.2.4
    gnu glibc 2.3
    gnu glibc 2.3.1
    gnu glibc 2.3.10
    gnu glibc 2.3.2
    gnu glibc 2.3.3
    gnu glibc 2.3.4
    gnu glibc 2.1.3.10
    gnu glibc 2.7
    gnu glibc 2.10.2
    gnu glibc 2.11.1
    gnu glibc 2.3.6
    gnu glibc 2.4
    gnu glibc 2.5
    gnu glibc 2.5.1
    gnu glibc 2.6
    gnu glibc 2.6.1
    gnu glibc 2.8
    gnu glibc 2.9
    gnu glibc 2.10
    gnu glibc 2.3.5
    gnu glibc 2.10.1
    gnu glibc 2.11
    gnu glibc 1.09
    gnu glibc 1.08
    gnu glibc 1.07
    gnu glibc 1.06
    gnu glibc 1.05
    gnu glibc 1.04
    gnu glibc 1.03
    gnu glibc 1.02
    gnu glibc 1.01
    gnu glibc 1.00
    gnu glibc 2.12.0
    gnu glibc 2.12.1
    gnu glibc 1.09.1
    gnu glibc 2.11.3
    gnu glibc 2.11.2
    gnu glibc 2.12.2
    gnu glibc 2.13
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 5
    redhat enterprise linux 5
    avaya communication manager 4.0
    avaya communication manager 5.0
    redhat enterprise linux 6
    redhat enterprise linux 6
    redhat enterprise linux desktop 6
    redhat enterprise linux hpc node 6
    redhat enterprise linux eus 5.6.z
    redhat enterprise linux long life 5.6