CVE-2013-7423

EUVD-2013-7187
The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux_server_aus
6.5
canonicalubuntu_linux
10.04
canonicalubuntu_linux
12.04
canonicalubuntu_linux
14.04
canonicalubuntu_linux
14.10
opensuseopensuse
13.1
opensuseopensuse
13.2
gnuglibc
𝑥
< 2.20
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
glibc
bookworm
2.36-9+deb12u8
fixed
bookworm (security)
2.36-9+deb12u7
fixed
bullseye
2.31-13+deb11u11
fixed
bullseye (security)
2.31-13+deb11u10
fixed
sid
2.40-3
fixed
trixie
2.40-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
eglibc
lucid
Fixed 2.11.1-0ubuntu7.21
released
precise
Fixed 2.15-0ubuntu10.11
released
trusty
Fixed 2.19-0ubuntu6.6
released
utopic
dne
glibc
lucid
dne
precise
dne
trusty
dne
utopic
not-affected
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html
http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html
http://rhn.redhat.com/errata/RHSA-2015-0863.html
http://seclists.org/fulldisclosure/2021/Sep/0
http://www.openwall.com/lists/oss-security/2015/01/28/20
http://www.securityfocus.com/bid/72844
http://www.ubuntu.com/usn/USN-2519-1
https://access.redhat.com/errata/RHSA-2016:1207
https://github.com/golang/go/issues/6336
https://security.gentoo.org/glsa/201602-02
https://sourceware.org/bugzilla/show_bug.cgi?id=15946
http://lists.opensuse.org/opensuse-updates/2015-02/msg00089.html
http://packetstormsecurity.com/files/164014/Moxa-Command-Injection-Cross-Site-Scripting-Vulnerable-Software.html
http://rhn.redhat.com/errata/RHSA-2015-0863.html
http://seclists.org/fulldisclosure/2021/Sep/0
http://www.openwall.com/lists/oss-security/2015/01/28/20
http://www.securityfocus.com/bid/72844
http://www.ubuntu.com/usn/USN-2519-1
https://access.redhat.com/errata/RHSA-2016:1207
https://github.com/golang/go/issues/6336
https://security.gentoo.org/glsa/201602-02
https://sourceware.org/bugzilla/show_bug.cgi?id=15946