CVE-2014-9984
critical
CVSS v3
9.8
CVSS v2
7.5
VIR risk
9.8
Description
nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.
Predictions
Exploit likelihood
97%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2014-9984
Vendor advisory: cve@mitre.org — https://sourceware.org/bugzilla/show_bug.cgi?id=16695
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2014-9984.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 2.19-14 |
| debian | bullseye | fixed | 2.19-14 |
| debian | forky | fixed | 2.19-14 |
| debian | sid | fixed | 2.19-14 |
| debian | trixie | fixed | 2.19-14 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| gnu | glibc | {"endIncluding":"2.19"} | |
References
- https://www.suse.com/security/cve/CVE-2014-9984.html
- http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html
- http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html
- http://seclists.org/fulldisclosure/2019/Jun/18
- http://seclists.org/fulldisclosure/2019/Sep/7
- http://www.securityfocus.com/bid/99071
- https://seclists.org/bugtraq/2019/Jun/14
- https://seclists.org/bugtraq/2019/Sep/7
- https://sourceware.org/bugzilla/show_bug.cgi?id=16695
- https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=c44496df2f090a56d3bf75df930592dac6bba46f
- https://security-tracker.debian.org/tracker/CVE-2014-9984
CWEs
CWE-119
Verify integrity in audit chain (admin only). AS-IS.