CVE-2010-4051

GNU libc/regcomp - Multiple Vulnerabilities

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."

La implementación de regcomp en la librería de C de GNU (también conocido como glibc o libc6) desde v2.11.3 y v2.12.x hasta v2.12.2, permite a atacantes dependientes de contexto provocar una denegación de servicio (caída de la aplicación) a través de una expresión regular que contiene repeticiones delimitadas adjacentes que pretenden evitar la limitación RE_DUP_MAX, como se demuestra mediante la secuencia {10} {10} {10} {10} {10} en el exploit proftpd.gnu.c para ProFTPD, relacionado con un desbordamiento de "RE_DUP_MAX".

Mac OS X, Safari, Firefox and Kaspersky all suffer from a regular expression denial of service condition that was discovered long ago in regcomp().

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-10-22 CVE Reserved
2011-01-07 First Exploit
2011-01-13 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CAPEC

References (14)

URL	Tag	Source
http://securitytracker.com/id?1024832	Vdb Entry
http://www.kb.cert.org/vuls/id/912279	Third Party Advisory
http://www.securityfocus.com/archive/1/515589/100/0/threaded	Mailing List
https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E	Mailing List

URL	Date	SRC
https://packetstorm.news/files/id/125725	2014-03-14
https://www.exploit-db.com/exploits/15935	2011-01-07
http://seclists.org/fulldisclosure/2011/Jan/78	2024-08-07
http://securityreason.com/achievement_securityalert/93	2024-08-07
http://securityreason.com/securityalert/8003	2024-08-07
http://www.exploit-db.com/exploits/15935	2024-08-07
http://www.securityfocus.com/bid/45233	2024-08-07
https://bugzilla.redhat.com/show_bug.cgi?id=645859	2024-08-07

URL	Date	SRC
http://cxib.net/stuff/proftpd.gnu.c	2023-11-07

URL	Date	SRC
http://secunia.com/advisories/42547	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.00 Search vendor "Gnu" for product "Glibc" and version "1.00"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.01 Search vendor "Gnu" for product "Glibc" and version "1.01"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.02 Search vendor "Gnu" for product "Glibc" and version "1.02"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.03 Search vendor "Gnu" for product "Glibc" and version "1.03"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.04 Search vendor "Gnu" for product "Glibc" and version "1.04"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.05 Search vendor "Gnu" for product "Glibc" and version "1.05"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.06 Search vendor "Gnu" for product "Glibc" and version "1.06"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.07 Search vendor "Gnu" for product "Glibc" and version "1.07"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.08 Search vendor "Gnu" for product "Glibc" and version "1.08"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.09 Search vendor "Gnu" for product "Glibc" and version "1.09"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				1.09.1 Search vendor "Gnu" for product "Glibc" and version "1.09.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1 Search vendor "Gnu" for product "Glibc" and version "2.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.1 Search vendor "Gnu" for product "Glibc" and version "2.1.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.1.6 Search vendor "Gnu" for product "Glibc" and version "2.1.1.6"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.2 Search vendor "Gnu" for product "Glibc" and version "2.1.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.3 Search vendor "Gnu" for product "Glibc" and version "2.1.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.3.10 Search vendor "Gnu" for product "Glibc" and version "2.1.3.10"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.1.9 Search vendor "Gnu" for product "Glibc" and version "2.1.9"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10 Search vendor "Gnu" for product "Glibc" and version "2.10"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10.1 Search vendor "Gnu" for product "Glibc" and version "2.10.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.10.2 Search vendor "Gnu" for product "Glibc" and version "2.10.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11 Search vendor "Gnu" for product "Glibc" and version "2.11"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.1 Search vendor "Gnu" for product "Glibc" and version "2.11.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.2 Search vendor "Gnu" for product "Glibc" and version "2.11.2"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.11.3 Search vendor "Gnu" for product "Glibc" and version "2.11.3"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.0 Search vendor "Gnu" for product "Glibc" and version "2.12.0"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.1 Search vendor "Gnu" for product "Glibc" and version "2.12.1"		-		Affected
Gnu Search vendor "Gnu"		Glibc Search vendor "Gnu" for product "Glibc"				2.12.2 Search vendor "Gnu" for product "Glibc" and version "2.12.2"		-		Affected