CVE-2010-4052

Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://cxib.net/stuff/proftpd.gnu.c	Patch
http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
http://secunia.com/advisories/42547	Vendor Advisory
http://securityreason.com/achievement_securityalert/93	Exploit
http://securityreason.com/securityalert/8003	Exploit
http://securitytracker.com/id?1024832
http://www.exploit-db.com/exploits/15935
http://www.kb.cert.org/vuls/id/912279	US Government Resource
http://www.securityfocus.com/archive/1/515589/100/0/threaded
http://www.securityfocus.com/bid/45233	Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit
http://cxib.net/stuff/proftpd.gnu.c	Patch
http://seclists.org/fulldisclosure/2011/Jan/78	Exploit
http://secunia.com/advisories/42547	Vendor Advisory
http://securityreason.com/achievement_securityalert/93	Exploit
http://securityreason.com/securityalert/8003	Exploit
http://securitytracker.com/id?1024832
http://www.exploit-db.com/exploits/15935
http://www.kb.cert.org/vuls/id/912279	US Government Resource
http://www.securityfocus.com/archive/1/515589/100/0/threaded
http://www.securityfocus.com/bid/45233	Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=645859	Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gnu:glibc:1.00:::::::*
	cpe:2.3:a:gnu:glibc:1.01:::::::*
	cpe:2.3:a:gnu:glibc:1.02:::::::*
	cpe:2.3:a:gnu:glibc:1.03:::::::*
	cpe:2.3:a:gnu:glibc:1.04:::::::*
	cpe:2.3:a:gnu:glibc:1.05:::::::*
	cpe:2.3:a:gnu:glibc:1.06:::::::*
	cpe:2.3:a:gnu:glibc:1.07:::::::*
	cpe:2.3:a:gnu:glibc:1.08:::::::*
	cpe:2.3:a:gnu:glibc:1.09:::::::*
	cpe:2.3:a:gnu:glibc:1.09.1:::::::*
	cpe:2.3:a:gnu:glibc:2.1:::::::*
	cpe:2.3:a:gnu:glibc:2.1.1:::::::*
	cpe:2.3:a:gnu:glibc:2.1.1.6:::::::*
	cpe:2.3:a:gnu:glibc:2.1.2:::::::*
	cpe:2.3:a:gnu:glibc:2.1.3:::::::*
	cpe:2.3:a:gnu:glibc:2.1.3.10:::::::*
	cpe:2.3:a:gnu:glibc:2.1.9:::::::*
	cpe:2.3:a:gnu:glibc:2.10:::::::*
	cpe:2.3:a:gnu:glibc:2.10.1:::::::*
	cpe:2.3:a:gnu:glibc:2.10.2:::::::*
	cpe:2.3:a:gnu:glibc:2.11:::::::*
	cpe:2.3:a:gnu:glibc:2.11.1:::::::*
	cpe:2.3:a:gnu:glibc:2.11.2:::::::*
	cpe:2.3:a:gnu:glibc:2.11.3:::::::*
	cpe:2.3:a:gnu:glibc:2.12.0:::::::*
	cpe:2.3:a:gnu:glibc:2.12.1:::::::*
	cpe:2.3:a:gnu:glibc:2.12.2:::::::*

History

21 Nov 2024, 01:20

Type	Values Removed	Values Added
References	~~() http://cxib.net/stuff/proftpd.gnu.c - Patch~~	() http://cxib.net/stuff/proftpd.gnu.c - Patch
References	~~() http://seclists.org/fulldisclosure/2011/Jan/78 - Exploit~~	() http://seclists.org/fulldisclosure/2011/Jan/78 - Exploit
References	~~() http://secunia.com/advisories/42547 - Vendor Advisory~~	() http://secunia.com/advisories/42547 - Vendor Advisory
References	~~() http://securityreason.com/achievement_securityalert/93 - Exploit~~	() http://securityreason.com/achievement_securityalert/93 - Exploit
References	~~() http://securityreason.com/securityalert/8003 - Exploit~~	() http://securityreason.com/securityalert/8003 - Exploit
References	~~() http://securitytracker.com/id?1024832 -~~	() http://securitytracker.com/id?1024832 -
References	~~() http://www.exploit-db.com/exploits/15935 -~~	() http://www.exploit-db.com/exploits/15935 -
References	~~() http://www.kb.cert.org/vuls/id/912279 - US Government Resource~~	() http://www.kb.cert.org/vuls/id/912279 - US Government Resource
References	~~() http://www.securityfocus.com/archive/1/515589/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/515589/100/0/threaded -
References	~~() http://www.securityfocus.com/bid/45233 - Exploit~~	() http://www.securityfocus.com/bid/45233 - Exploit
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=645859 - Exploit~~	() https://bugzilla.redhat.com/show_bug.cgi?id=645859 - Exploit

Information

Published : 2011-01-13 19:00

Updated : 2025-04-11 00:51

NVD link : CVE-2010-4052

Mitre link : CVE-2010-4052

CVE.ORG link : CVE-2010-4052

JSON object : View

Products Affected

gnu

glibc

CWE

CWE-399

Resource Management Errors

{"id": "CVE-2010-4052", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-01-13T19:00:02.963", "references": [{"url": "http://cxib.net/stuff/proftpd.gnu.c", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2011/Jan/78", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/42547", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/achievement_securityalert/93", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/8003", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1024832", "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/15935", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/912279", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/515589/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/45233", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=645859", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://cxib.net/stuff/proftpd.gnu.c", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2011/Jan/78", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/42547", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/achievement_securityalert/93", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/8003", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securitytracker.com/id?1024832", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.exploit-db.com/exploits/15935", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.kb.cert.org/vuls/id/912279", "tags": ["US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/515589/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/45233", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=645859", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-399"}]}], "descriptions": [{"lang": "en", "value": "Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD."}, {"lang": "es", "value": "Vulnerabilidad de lconsumo de pila de memoria en la aplicaci\u00f3n regcomp en la Biblioteca de C de GNU (tambi\u00e9n conocido como glibc o libc6) hasta v2.11.3, y v2.12.x hasta v2.12.2, permite a atacantes dependientes de contexto para provocar una denegaci\u00f3n de servicio (agotamiento de recursos) a trav\u00e9s de expresi\u00f3n regular que contiene operadores de repetici\u00f3n adyacentes, como se demuestra con una secuencia {10} {10} {10} {10} en el exploit proftpd.gnu.c para ProFTPD."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnu:glibc:1.00:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA23C241-132B-423E-A22A-7206A8074D10"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F79978B1-8831-4169-B815-80138C85832C"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "991EB676-F043-418D-BD81-0BB937236D40"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA0C5DB0-602E-4296-884C-60E24FC80458"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3211F47C-DF6D-4355-95F8-DED317700621"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.05:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "229BFD88-A90F-4D2B-97B9-822A7D87EAEA"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.06:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFE253B0-D8E0-4099-8CA7-8925B4809F88"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.07:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D640F556-8181-4F15-B2F7-7EC7E8869FB7"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.08:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "061383CD-B9AD-41C6-8C46-F79870B9CD22"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.09:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9897B03F-A457-4B29-9C5E-FEA084D3BF0F"}, {"criteria": "cpe:2.3:a:gnu:glibc:1.09.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7C3684B-CE01-46B5-9E41-BF58E6A5AA64"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E2A0F12-FD00-40B9-86AD-7D082385E5DB"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8ED8F0E8-A969-4F7F-A100-662F4A5426FD"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9416576F-A605-45BE-AA01-FEF357A66979"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE582B8F-4E31-4D0F-B2F9-AC83C855F751"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB56D9C9-13B3-418C-B06C-0997E165F1C7"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.3.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AFD93D5-70BB-475C-BDD3-DEDE9965C5BA"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.1.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19D5667D-5EA4-4B44-BF8A-9C10506BD4E6"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3D70AB0-2910-4191-9980-5BA78E8F2E11"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A30D0EE-1AED-4C99-8A22-24E47212F3FD"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.10.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A93600D-7271-4AF5-8133-C6AA5BC8543F"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4169CA4B-C4F5-499A-A35A-49DD43AC0A22"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3AC9749-52C5-4E17-8A77-5F4ED91FA8E3"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.11.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C55E32EC-33A6-4145-9B76-C7E3DBACD1E1"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.11.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6423F0B5-E483-4DE9-B13F-3A7322F055DC"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0B4AFFF-A537-44BD-B97A-EFA9409DB8BB"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.12.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C543B0E8-8B48-44A4-B63F-B2D9EA23E8EE"}, {"criteria": "cpe:2.3:a:gnu:glibc:2.12.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37880948-2AB5-491A-85E2-B7E271E03B1D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

5.0 /10