Vulnerability-Lookup

ubuntu-cve-2014-9402

Vulnerability from osv_ubuntu

Published

2015-02-24 00:00

Modified

2026-04-22 07:37

Summary

Details

The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.

Severity

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2014-9402	REPORT
	https://ubuntu.com/security/notices/USN-2519-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2014-9402	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "eglibc-source",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-ppc64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-ppc64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.19-0ubuntu6.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "eglibc",
        "purl": "pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.6?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19-0ubuntu6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.17-93ubuntu4",
        "2.18-0ubuntu1",
        "2.18-0ubuntu2",
        "2.18-0ubuntu4",
        "2.18-0ubuntu5",
        "2.18-0ubuntu6",
        "2.18-0ubuntu7",
        "2.19-0ubuntu2",
        "2.19-0ubuntu3",
        "2.19-0ubuntu4",
        "2.19-0ubuntu5",
        "2.19-0ubuntu6",
        "2.19-0ubuntu6.1",
        "2.19-0ubuntu6.3",
        "2.19-0ubuntu6.4",
        "2.19-0ubuntu6.5"
      ]
    }
  ],
  "aliases": [],
  "details": "The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process.",
  "id": "UBUNTU-CVE-2014-9402",
  "modified": "2026-04-22T07:37:44Z",
  "published": "2015-02-24T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9402"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2519-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-9402"
    }
  ],
  "related": [
    "USN-2519-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2014-9402"
  ]
}

CVE-2014-9402 (GCVE-0-2014-9402)

Vulnerability from cvelistv5 – Published: 2015-02-24 15:00 – Updated: 2024-08-06 13:40

Summary

Severity

No CVSS data available.

CWE

Assigner

redhat

References

14 references

URL	Tags
http://www.oracle.com/technetwork/security-adviso…	x_refsource_CONFIRM
https://sourceware.org/bugzilla/show_bug.cgi?id=17630	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2015-0…	vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/201602-02	vendor-advisoryx_refsource_GENTOO
http://www.openwall.com/lists/oss-security/2014/12/18/1	mailing-listx_refsource_MLIST
http://www.ubuntu.com/usn/USN-2519-1	vendor-advisoryx_refsource_UBUNTU
http://www.securityfocus.com/bid/71670	vdb-entryx_refsource_BID
https://access.redhat.com/errata/RHSA-2018:0805	vendor-advisoryx_refsource_REDHAT
http://seclists.org/fulldisclosure/2019/Jun/18	mailing-listx_refsource_FULLDISC
https://seclists.org/bugtraq/2019/Jun/14	mailing-listx_refsource_BUGTRAQ
http://packetstormsecurity.com/files/153278/WAGO-…	x_refsource_MISC
http://seclists.org/fulldisclosure/2019/Sep/7	mailing-listx_refsource_FULLDISC
https://seclists.org/bugtraq/2019/Sep/7	mailing-listx_refsource_BUGTRAQ
http://packetstormsecurity.com/files/154361/Cisco…	x_refsource_MISC

Date Public

2014-11-20 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:40:25.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=17630"
          },
          {
            "name": "openSUSE-SU-2015:0351",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html"
          },
          {
            "name": "GLSA-201602-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201602-02"
          },
          {
            "name": "[oss-security] 20141217 Re: CVE request: glibc",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2014/12/18/1"
          },
          {
            "name": "USN-2519-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2519-1"
          },
          {
            "name": "71670",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/71670"
          },
          {
            "name": "RHSA-2018:0805",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2018:0805"
          },
          {
            "name": "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Jun/18"
          },
          {
            "name": "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Jun/14"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html"
          },
          {
            "name": "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2019/Sep/7"
          },
          {
            "name": "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/Sep/7"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-11-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The nss_dns implementation of getnetbyname in GNU C Library (aka glibc) before 2.21, when the DNS backend in the Name Service Switch configuration is enabled, allows remote attackers to cause a denial of service (infinite loop) by sending a positive answer while a network name is being process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-09-05T01:06:06.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=17630"
        },
        {
          "name": "openSUSE-SU-2015:0351",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html"
        },
        {
          "name": "GLSA-201602-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201602-02"
        },
        {
          "name": "[oss-security] 20141217 Re: CVE request: glibc",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2014/12/18/1"
        },
        {
          "name": "USN-2519-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2519-1"
        },
        {
          "name": "71670",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/71670"
        },
        {
          "name": "RHSA-2018:0805",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2018:0805"
        },
        {
          "name": "20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Jun/18"
        },
        {
          "name": "20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Jun/14"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html"
        },
        {
          "name": "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2019/Sep/7"
        },
        {
          "name": "20190904 SEC Consult SA-20190904-0 :: Multiple vulnerabilities in Cisco router series RV34X, RV26X and RV16X",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/Sep/7"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2014-9402",
    "datePublished": "2015-02-24T15:00:00.000Z",
    "dateReserved": "2014-12-17T00:00:00.000Z",
    "dateUpdated": "2024-08-06T13:40:25.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-2519-1

Vulnerability from osv_ubuntu

Published

2015-02-26 15:57

Modified

2026-04-22 07:36

Summary

eglibc, glibc vulnerabilities

Details

Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file descriptors when resolving DNS queries under high load. This may cause a denial of service in other applications, or an information leak. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2013-7423)

It was discovered that the GNU C Library incorrectly handled receiving a positive answer while processing the network name when performing DNS resolution. A remote attacker could use this issue to cause the GNU C Library to hang, resulting in a denial of service. (CVE-2014-9402)

Joseph Myers discovered that the GNU C Library wscanf function incorrectly handled memory. A remote attacker could possibly use this issue to cause the GNU C Library to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-1472, CVE-2015-1473)

References

URL

Type

	https://ubuntu.com/security/notices/USN-2519-1	ADVISORY
	https://ubuntu.com/security/CVE-2013-7423	REPORT
	https://ubuntu.com/security/CVE-2014-9402	REPORT
	https://ubuntu.com/security/CVE-2015-1472	REPORT
	https://ubuntu.com/security/CVE-2015-1473	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2013-7423",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-9402",
              "severity": [
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-1472",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2015-1473",
              "severity": [
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "eglibc-source",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc-bin",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc-dev-bin",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-amd64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-armel",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-amd64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-armel",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-i386",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-ppc64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-dev-x32",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-i386",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-pic",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-ppc64",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-prof",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "libc6-x32",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "multiarch-support",
            "binary_version": "2.19-0ubuntu6.6"
          },
          {
            "binary_name": "nscd",
            "binary_version": "2.19-0ubuntu6.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "eglibc",
        "purl": "pkg:deb/ubuntu/eglibc@2.19-0ubuntu6.6?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.19-0ubuntu6.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.17-93ubuntu4",
        "2.18-0ubuntu1",
        "2.18-0ubuntu2",
        "2.18-0ubuntu4",
        "2.18-0ubuntu5",
        "2.18-0ubuntu6",
        "2.18-0ubuntu7",
        "2.19-0ubuntu2",
        "2.19-0ubuntu3",
        "2.19-0ubuntu4",
        "2.19-0ubuntu5",
        "2.19-0ubuntu6",
        "2.19-0ubuntu6.1",
        "2.19-0ubuntu6.3",
        "2.19-0ubuntu6.4",
        "2.19-0ubuntu6.5"
      ]
    }
  ],
  "aliases": [],
  "details": "Arnaud Le Blanc discovered that the GNU C Library incorrectly handled file\ndescriptors when resolving DNS queries under high load. This may cause a\ndenial of service in other applications, or an information leak. This issue\nonly affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS.\n(CVE-2013-7423)\n\nIt was discovered that the GNU C Library incorrectly handled receiving a\npositive answer while processing the network name when performing DNS\nresolution. A remote attacker could use this issue to cause the GNU C\nLibrary to hang, resulting in a denial of service. (CVE-2014-9402)\n\nJoseph Myers discovered that the GNU C Library wscanf function incorrectly\nhandled memory. A remote attacker could possibly use this issue to cause\nthe GNU C Library to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 12.04 LTS, Ubuntu\n14.04 LTS and Ubuntu 14.10. (CVE-2015-1472, CVE-2015-1473)\n",
  "id": "USN-2519-1",
  "modified": "2026-04-22T07:36:32Z",
  "published": "2015-02-26T15:57:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2519-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2013-7423"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-9402"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-1472"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2015-1473"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "eglibc, glibc vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2013-7423",
    "UBUNTU-CVE-2014-9402",
    "UBUNTU-CVE-2015-1472",
    "UBUNTU-CVE-2015-1473"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2014-9402

Vulnerability from osv_ubuntu

CVE-2014-9402 (GCVE-0-2014-9402)

usn-2519-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature