National Cyber Awareness System

Vulnerability Summary for CVE-2010-0830

Overview

Integer signedness error in the elf_get_dynamic_info function in elf/dynamic-link.h in ld.so in the GNU C Library (aka glibc or libc6) 2.0.1 through 2.11.1, when the --verify option is used, allows user-assisted remote attackers to execute arbitrary code via a crafted ELF program with a negative value for a certain d_tag structure member in the ELF header.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 40063

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/40063

External Source: XF

Name: glibc-elf-code-execution(58915)

Hyperlink:http://xforce.iss.net/xforce/xfdb/58915

External Source: VUPEN

Name: ADV-2010-1246

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/1246

External Source: UBUNTU

Name: USN-944-1

Hyperlink:http://www.ubuntu.com/usn/USN-944-1

External Source: MANDRIVA

Name: MDVSA-2010:112

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:112

External Source: MANDRIVA

Name: MDVSA-2010:111

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:111

External Source: DEBIAN

Name: DSA-2058

Hyperlink:http://www.debian.org/security/2010/dsa-2058

External Source: CONFIRM

Name: http://sourceware.org/git/?p=glibc.git;a=commit;h=db07e962b6ea963dbb345439f6ab9b0cf74d87c5

Hyperlink:http://sourceware.org/git/?p=glibc.git;a=commit;h=db07e962b6ea963dbb345439f6ab9b0cf74d87c5

External Source: SECTRACK

Name: 1024044

Hyperlink:http://securitytracker.com/id?1024044

External Source: GENTOO

Name: GLSA-201011-01

Hyperlink:http://security.gentoo.org/glsa/glsa-201011-01.xml

External Source: SECUNIA

Name: 39900

Type: Advisory

Hyperlink:http://secunia.com/advisories/39900

External Source: CONFIRM

Name: http://frugalware.org/security/662

Hyperlink:http://frugalware.org/security/662

External Source: MISC

Name: http://drosenbe.blogspot.com/2010/05/integer-overflow-in-ldso-cve-2010-0830.html

Hyperlink:http://drosenbe.blogspot.com/2010/05/integer-overflow-in-ldso-cve-2010-0830.html