CVE编号
CVE-2017-1000366利用情况
暂无补丁情况
官方补丁披露时间
2017-06-20漏洞描述
glibc是GNU发布的libc库，即c运行库。glibc是linux系统中最底层的api，几乎其它任何运行库都会依赖于glibc。glibc 中存在安全漏洞。受影响的的版本有2.25以及更早版本。攻击者可利用该漏洞执行任意代码。解决建议
厂商补丁：GNU
---
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
https://access.redhat.com/security/cve/CVE-2017-1000366
https://www.suse.com/security/cve/CVE-2017-1000366/
https://www.suse.com/support/kb/doc/?id=7020973
参考链接 |
|
|---|---|
| http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credential... | |
| http://seclists.org/fulldisclosure/2019/Sep/7 | |
| http://www.debian.org/security/2017/dsa-3887 | |
| http://www.securityfocus.com/bid/99127 | |
| http://www.securitytracker.com/id/1038712 | |
| https://access.redhat.com/errata/RHSA-2017:1479 | |
| https://access.redhat.com/errata/RHSA-2017:1480 | |
| https://access.redhat.com/errata/RHSA-2017:1481 | |
| https://access.redhat.com/errata/RHSA-2017:1567 | |
| https://access.redhat.com/errata/RHSA-2017:1712 | |
| https://access.redhat.com/security/cve/CVE-2017-1000366 | |
| https://kc.mcafee.com/corporate/index?page=content&id=SB10205 | |
| https://seclists.org/bugtraq/2019/Sep/7 | |
| https://security.gentoo.org/glsa/201706-19 | |
| https://www.exploit-db.com/exploits/42274/ | |
| https://www.exploit-db.com/exploits/42275/ | |
| https://www.exploit-db.com/exploits/42276/ | |
| https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt | |
| https://www.suse.com/security/cve/CVE-2017-1000366/ | |
| https://www.suse.com/support/kb/doc/?id=7020973 |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | gnu | glibc | * |
Up to (including) 2.25 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
Up to (including) 7.6.2.14 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | mcafee | web_gateway | * |
From (including) 7.7.0.0 |
Up to (including) 7.7.2.2 |
||||
| 运行在以下环境 | |||||||||
| 应用 | openstack | cloud_magnum_orchestration | 7 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | glibc | * |
Up to (excluding) 2.17-157.170.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | glibc | * |
Up to (excluding) 2.17-157.170.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_6 | glibc | * |
Up to (excluding) 2.12-1.209.el6_9.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | glibc | * |
Up to (excluding) 2.17-157.el7_3.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 9.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian | DPKG | * |
Up to (excluding) 2.24-11+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_7 | glibc | * |
Up to (excluding) 2.13-38+deb7u12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | glibc | * |
Up to (excluding) 2.19-18+deb8u4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | glibc | * |
Up to (excluding) 2.24-11+deb9u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_24 | glibc | * |
Up to (excluding) 2.23.1-12.fc24 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_25 | glibc | * |
Up to (excluding) 2.24-8.fc25 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_26 | glibc | * |
Up to (excluding) 2.25-6.fc26 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | novell | suse_linux_enterprise_desktop | 12.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | novell | suse_linux_enterprise_point_of_sale | 11.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | novell | suse_linux_enterprise_server | 11.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse | leap | 42.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.2 | glibc | * |
Up to (excluding) 2.22-4.9.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_5 | glibc | * |
Up to (excluding) 2.5-123.0.2.el5_11.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_6 | glibc | * |
Up to (excluding) 2.12-1.209.0.3.el6_9.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_7 | glibc | * |
Up to (excluding) 2.17-157.el7_3.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_5 | glibc | * |
Up to (excluding) 2.5-123.0.2.el5_11.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | glibc | * |
Up to (excluding) 2.12-1.209.0.3.el6_9.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | glibc | * |
Up to (excluding) 2.17-157.el7_3.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_desktop | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_desktop | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server | 6.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 5.9 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 6.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 6.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 6.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 7.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 7.3 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 7.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_aus | 7.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 6.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 6.7 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 7.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 7.3 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 7.4 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 7.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_eus | 7.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_long_life | 5.9 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_tus | 6.5 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_tus | 6.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_tus | 7.2 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_tus | 7.3 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_server_tus | 7.6 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_workstation | 6.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux_workstation | 7.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_5 | glibc | * |
Up to (excluding) 0:2.5-123.el5_11.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | glibc | * |
Up to (excluding) 0:2.12-1.209.el6_9.2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | glibc | * |
Up to (excluding) 0:2.17-157.el7_3.4 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_11_SP4 | glibc | * |
Up to (excluding) 2.11.3-17.109.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | sles12-docker-image | * |
Up to (excluding) 1.1.4-20171002 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP2 | glibc | * |
Up to (excluding) 2.22-61.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_for_sap | 12 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_server | 10 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_server | 11 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_server | 12 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_server_for_raspberry_pi | 12 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_software_development_kit | 11.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse | linux_enterprise_software_development_kit | 12.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_11_SP4 | glibc | * |
Up to (excluding) 2.11.3-17.109.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP2 | glibc | * |
Up to (excluding) 2.22-61.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04 | glibc | * |
Up to (excluding) 2.19-0ubuntu6.13 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_14.04_lts | eglibc | * |
Up to (excluding) 2.19-0ubuntu6.13 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | glibc | * |
Up to (excluding) 2.23-0ubuntu9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04_lts | glibc | * |
Up to (excluding) 2.23-0ubuntu9 |
|||||
- 攻击路径 本地
- 攻击复杂度 复杂
- 权限要求 普通权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...