Vulnerability Name:

CVE-2016-10228 (CCN-124078)

Assigned:2017-01-25
Published:2017-01-25
Updated:2022-10-17
Summary:The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.
CVSS v3 Severity:5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): High
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
3.3 Low (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
2.9 Low (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:R)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-20
CWE-835
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2016-10228

Source: CCN
Type: oss-sec Mailing List, Wed, 1 Mar 2017 17:57:23 +0100
CVE-2016-10228: glibc iconv program can hang whe Thu, 15 Sep 2016 01:19:26 -0400 (EDT)n invoked with the -c option

Source: CONFIRM
Type: Mailing List, Third Party Advisory
http://openwall.com/lists/oss-security/2017/03/01/10

Source: CCN
Type: GNU C Library Web site
The GNU C Library

Source: BID
Type: UNKNOWN
96525

Source: CCN
Type: BID-96525
GNU glibc CVE-2016-10228 Infinite Loop Denial of Service Vulnerability

Source: XF
Type: UNKNOWN
glibc-cve201610228-dos(124078)

Source: MLIST
Type: UNKNOWN
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar

Source: MLIST
Type: UNKNOWN
[debian-lts-announce] 20221017 [SECURITY] [DLA 3152-1] glibc security update

Source: GENTOO
Type: UNKNOWN
GLSA-202101-20

Source: CONFIRM
Type: Issue Tracking
https://sourceware.org/bugzilla/show_bug.cgi?id=19519

Source: CONFIRM
Type: UNKNOWN
https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21

Source: CONFIRM
Type: UNKNOWN
https://sourceware.org/bugzilla/show_bug.cgi?id=26224

Source: CCN
Type: IBM Security Bulletin 960426 (VRA Vyatta 5600)
Vyatta 5600 vRouter Software Patches - Release 1801-za

Source: CCN
Type: IBM Security Bulletin 6493729 (Cloud Pak for Security)
Cloud Pak for Security is vulnerable to several CVEs

Source: CCN
Type: IBM Security Bulletin 6520474 (QRadar SIEM)
IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6538418 (Security Verify Access)
Multiple Security Vulnerabilities fixed in IBM Security Verify Access

Source: MISC
Type: UNKNOWN
https://www.oracle.com/security-alerts/cpuapr2022.html

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:glibc:*:*:*:*:*:*:*:* (Version <= 2.25)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:8::baseos:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:glibc:2.25:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:qradar_security_information_and_event_manager:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:virtual_router_appliance_firmware:vyatta_5600:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:qradar_security_information_and_event_manager:7.4:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_access:10.0.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_verify_access:10.0.1.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8010
    P
    		glibc-devel-32bit-2.31-150300.46.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7510
    P
    		glibc-2.31-150300.46.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:3531
    P
    		java-11-openjdk-11.0.4.0-1.26 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3385
    P
    		tpm2.0-tools-3.1.4-1.12 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94929
    P
    		libXt6-32bit-1.1.5-2.24 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94565
    P
    		glibc-2.31-150300.20.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:2935
    P
    		glibc-2.31-150300.20.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95015
    P
    		glibc-devel-32bit-2.31-150300.20.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94643
    P
    		libidn2-0-2.2.0-3.6.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:68
    P
    		glibc-2.31-7.30 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:102162
    P
    		Security update for firewalld, golang-github-prometheus-prometheus (Important)
    2022-04-27
    oval:org.opensuse.security:def:101642
    P
    		Security update for jasper (Moderate)
    2022-02-24
    oval:org.opensuse.security:def:112305
    P
    		glibc-2.34-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:997
    P
    		Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-operator-container (Important)
    2022-01-10
    oval:org.opensuse.security:def:111159
    P
    		Security update for glibc (Moderate)
    2021-12-10
    oval:org.opensuse.security:def:108022
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:42141
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:64620
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:117536
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:4520
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:108308
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:65609
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:73742
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:117822
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:95449
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:5901
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:108828
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:66990
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:74677
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:101356
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:76058
    P
    		Security update for glibc (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:105828
    P
    		glibc-2.34-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:72727
    P
    		glibc-devel-32bit-2.31-7.20 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62086
    P
    		glibc-2.31-7.30 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:100844
    P
    		glibc-2.31-7.30 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1919
    P
    		glibc-devel-32bit-2.31-7.20 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63008
    P
    		glibc-devel-32bit-2.31-7.20 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:71827
    P
    		glibc-2.31-7.30 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101266
    P
    		glibc-devel-32bit-2.31-7.20 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:34493
    P
    		Security update for glibc (Moderate)
    2021-07-27
    oval:org.opensuse.security:def:60316
    P
    		Security update for glibc (Moderate)
    2021-07-27
    oval:org.opensuse.security:def:26095
    P
    		Security update for glibc (Moderate)
    2021-07-27
    oval:org.opensuse.security:def:5082
    P
    		Security update for glibc (Moderate)
    2021-07-27
    oval:com.redhat.rhsa:def:20211585
    P
    		RHSA-2021:1585: glibc security, bug fix, and enhancement update (Moderate)
    2021-05-18
    oval:com.ubuntu.bionic:def:2016102280000000
    V
    		CVE-2016-10228 on Ubuntu 18.04 LTS (bionic) - negligible.
    2017-03-02
    oval:com.ubuntu.xenial:def:2016102280000000
    V
    		CVE-2016-10228 on Ubuntu 16.04 LTS (xenial) - negligible.
    2017-03-02
    oval:com.ubuntu.disco:def:2016102280000000
    V
    		CVE-2016-10228 on Ubuntu 19.04 (disco) - negligible.
    2017-03-02
    oval:com.ubuntu.artful:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 17.10 (artful) - negligible.
    2017-03-01
    oval:com.ubuntu.trusty:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 14.04 LTS (trusty) - negligible.
    2017-03-01
    oval:com.ubuntu.bionic:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 18.04 LTS (bionic) - negligible.
    2017-03-01
    oval:com.ubuntu.xenial:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 16.04 LTS (xenial) - negligible.
    2017-03-01
    oval:com.ubuntu.cosmic:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 18.10 (cosmic) - negligible.
    2017-03-01
    oval:com.ubuntu.cosmic:def:2016102280000000
    V
    		CVE-2016-10228 on Ubuntu 18.10 (cosmic) - negligible.
    2017-03-01
    oval:com.ubuntu.precise:def:201610228000
    V
    		CVE-2016-10228 on Ubuntu 12.04 LTS (precise) - negligible.
    2017-03-01
    BACK
    gnu glibc *
    gnu glibc 2.25
    ibm qradar security information and event manager 7.3
    ibm virtual router appliance firmware vyatta_5600
    ibm qradar security information and event manager 7.4 -
    ibm security verify access 10.0.0
    ibm security verify access 10.0.2.0
    ibm cloud pak for security 1.7.0.0
    ibm cloud pak for security 1.7.1.0
    ibm cloud pak for security 1.7.2.0
    ibm security verify access 10.0.1.0