CVE-2011-1071 Denial of service in n/a

Medium 5.1 Published 8 Apr 2011 Updated 6 Aug 2024

Attackers can execute arbitrary code or cause denial of service via long UTF8 strings in fnmatch calls within the GNU C Library.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2011-1071?

CVE-2011-1071 is a medium-severity denial of service vulnerability in Gnu Glibc, published on 8 Apr 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.

Weakness: CWE-399

Which versions are affected by CVE-2011-1071?

It affects 2 products.

Products include Gnu Eglibc, Gnu Glibc.

How do I fix CVE-2011-1071?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-1071 being exploited?

There is no known exploitation of CVE-2011-1071 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

All Gnu Glibc vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-1071, GHSA-w4p3-xg4g-ff4x.