CVE-2014-9402 in C Library

Summary

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.

Be aware that VulDB is the high quality source for vulnerability data.

Reservation

12/17/2014

Disclosure

02/24/2015

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
74286	GNU C Library DNS Implementation resource management	399	Not defined	Official fix	CVE-2014-9402
68431	GNU C Library getanswer_r resource management	399	Unproven	Official fix	CVE-2014-9402

Sources

• MITRE
• NVD
• CVE Details