Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability
Informations
Name VU#695940 First vendor Publication 2015-02-13
Vendor VU-CERT Last vendor Modification 2015-02-27
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#695940

Henry Spencer regular expressions (regex) library contains a heap overflow vulnerability

Original Release date: 13 Feb 2015 | Last revised: 27 Feb 2015

Overview

A regular expressions C library originally written by Henry Spencer is vulnerable to a heap overflow in some circumstances.

Description

CWE-122: Heap-based Buffer Overflow

From the researcher, the variable len that holds the length of a regular expression string is "enlarged to such an extent that, in the process of enlarging (multiplication and addition), causes the 32 bit register/variable to overflow." It may be possible for an attacker to use this overflow to change data in memory.

More details are given on the researcher's blog.

The nature of the overflow suggests that only 32-bit operating systems are affected; it is highly unlikely that 64-bit operating systems would allow such an overflow.

Impact

The complete impact of this vulnerability is not yet known. Since the library is utilized in different ways, the impact is likely to vary depending on vendor. In worst case, a malicious actor may be able to execute arbitrary code.

Solution

Apply an update

Check with your vendor to see if an update is available to address this vulnerability. See the Vendor List below for more information.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Debian GNU/LinuxAffected06 Feb 201509 Feb 2015
DragonFly BSD ProjectAffected06 Feb 201513 Feb 2015
FreeBSD ProjectAffected06 Feb 201509 Feb 2015
NetBSDAffected06 Feb 201509 Feb 2015
Wind River Systems, Inc.Affected06 Feb 201509 Feb 2015
Check Point Software TechnologiesNot Affected06 Feb 201524 Feb 2015
Fortinet, Inc.Not Affected06 Feb 201527 Feb 2015
Global Technology Associates, Inc.Not Affected06 Feb 201509 Feb 2015
Juniper Networks, Inc.Not Affected06 Feb 201509 Feb 2015
OpenBSDNot Affected06 Feb 201509 Feb 2015
ACCESSUnknown06 Feb 201506 Feb 2015
Alcatel-LucentUnknown06 Feb 201506 Feb 2015
AppleUnknown06 Feb 201506 Feb 2015
Arch LinuxUnknown06 Feb 201506 Feb 2015
AT&TUnknown06 Feb 201506 Feb 2015
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

GroupScoreVector
Base4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
Temporal3.9E:POC/RL:U/RC:C
Environmental2.9CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

  • https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/
  • http://gitweb.dragonflybsd.org/dragonfly.git/blobdiff/4d133046c59a851141519d03553a70e903b3eefc..2841837793bd095a82f477e9c370cfe6cfb3862c:/lib/libc/regex/regcomp.c

Credit

This vulnerability was reported publicly by Guido Vranken.

This document was written by Garret Wassermann.

Other Information

  • CVE IDs:Unknown
  • Date Public:04 Feb 2015
  • Date First Published:13 Feb 2015
  • Date Last Updated:27 Feb 2015
  • Document Revision:28

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/695940

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-190 Integer Overflow or Wraparound (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:29157
 
Oval ID: oval:org.mitre.oval:def:29157
Title: HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Denial of Service (DoS) and Other Vulnerabilities
Description: Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.
Family: unix Class: vulnerability
Reference(s): CVE-2015-2305
Version: 3
Platform(s): HP-UX 11
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 618
Application 1
Os 5
Os 2
Os 2

Nessus® Vulnerability Scanner

Date Description
2016-08-29 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2016-1638-1.nasl - Type : ACT_GATHER_INFO
2016-03-01 Name : The remote Debian host is missing a security update.
File : debian_DLA-444.nasl - Type : ACT_GATHER_INFO
2015-10-05 Name : The remote host is missing a Mac OS X update that fixes multiple security vul...
File : macosx_10_11.nasl - Type : ACT_GATHER_INFO
2015-06-10 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1018-1.nasl - Type : ACT_GATHER_INFO
2015-05-27 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-0946-1.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-366.nasl - Type : ACT_GATHER_INFO
2015-05-20 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_3d0428b2fdfb11e4894fd050996490d0.nasl - Type : ACT_GATHER_INFO
2015-05-18 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-524.nasl - Type : ACT_GATHER_INFO
2015-05-14 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_clamav-150507.nasl - Type : ACT_GATHER_INFO
2015-05-13 Name : The remote Fedora host is missing a security update.
File : fedora_2015-7378.nasl - Type : ACT_GATHER_INFO
2015-05-12 Name : The antivirus service running on the remote host is affected by multiple vuln...
File : clamav_0_98_7.nasl - Type : ACT_GATHER_INFO
2015-05-06 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2594-1.nasl - Type : ACT_GATHER_INFO
2015-05-05 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-221.nasl - Type : ACT_GATHER_INFO
2015-05-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-7346.nasl - Type : ACT_GATHER_INFO
2015-05-04 Name : The remote Fedora host is missing a security update.
File : fedora_2015-7334.nasl - Type : ACT_GATHER_INFO
2015-04-22 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2015-111-10.nasl - Type : ACT_GATHER_INFO
2015-04-21 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2572-1.nasl - Type : ACT_GATHER_INFO
2015-04-17 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-508.nasl - Type : ACT_GATHER_INFO
2015-04-17 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-507.nasl - Type : ACT_GATHER_INFO
2015-04-17 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-506.nasl - Type : ACT_GATHER_INFO
2015-04-02 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-282.nasl - Type : ACT_GATHER_INFO
2015-04-02 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_742563d4d77611e4b5954061861086c1.nasl - Type : ACT_GATHER_INFO
2015-03-31 Name : The remote Fedora host is missing a security update.
File : fedora_2015-4236.nasl - Type : ACT_GATHER_INFO
2015-03-27 Name : The remote Fedora host is missing a security update.
File : fedora_2015-4255.nasl - Type : ACT_GATHER_INFO
2015-03-24 Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_5_6_7.nasl - Type : ACT_GATHER_INFO
2015-03-24 Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_5_5_23.nasl - Type : ACT_GATHER_INFO
2015-03-24 Name : The remote web server uses a version of PHP that is affected by multiple vuln...
File : php_5_4_39.nasl - Type : ACT_GATHER_INFO
2015-03-19 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3195.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2015-05-13 13:28:10
  • Multiple Updates
2015-03-31 00:29:33
  • Multiple Updates
2015-03-30 17:29:48
  • Multiple Updates
2015-02-27 17:22:02
  • Multiple Updates
2015-02-24 17:21:52
  • Multiple Updates
2015-02-14 05:21:24
  • Multiple Updates
2015-02-13 21:22:46
  • First insertion