GNU C Library up to 2.29 Regular Expression posix/regexec.c proceed_next_node out-of-bounds

Summaryinfo

A vulnerability identified as critical has been detected in GNU C Library up to 2.29. This impacts the function proceed_next_node of the file posix/regexec.c of the component Regular Expression Handler. Performing a manipulation results in out-of-bounds. This vulnerability is reported as CVE-2019-9169. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in GNU C Library up to 2.29 (Software Library). It has been classified as critical. This affects the function proceed_next_node of the file posix/regexec.c of the component Regular Expression Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

The bug was discovered 03/05/2019. The weakness was disclosed 02/26/2019 (Website). The advisory is shared at securityfocus.com. This vulnerability is uniquely identified as CVE-2019-9169 since 02/25/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 13476 (McAfee Web Gateway Multiple Vulnerabilities (SB10278)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 107160†). The entries VDB-131215, VDB-131216 and VDB-132015 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Software Library

Vendor

• GNU

Name

• C Library

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion