Actu
Vigil@nce - glibc: denial of service via calloc
April 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use an error in the calloc() implementation by the
glibc, in order to trigger a denial of service, or to obtain
sensitive information.
Impacted products: McAfee Email Gateway, McAfee MOVE AntiVirus,
VirusScan, McAfee Web Gateway, RHEL, Unix (platform) not
comprehensive.
Severity: 2/4.
Creation date: 16/02/2016.
DESCRIPTION OF THE VULNERABILITY
The calloc() function allocates a memory area, which is
initialized with zeros.
However, in some cases, the calloc() implementation in the glibc
does not set to zero some memory areas. An application compiled
with the glibc can thus have to manage unexpected data.
An attacker can therefore use an error in the calloc()
implementation by the glibc, in order to trigger a denial of
service, or to obtain sensitive information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/glibc-denial-of-service-via-calloc-18959
