Security Bulletin: GNU C library (glibc) vulnerabilities affect IBM SmartCloud Entry (CVE-2014-8121)

Summary

IBM SmartCloud Entry is vulnerable to GNU C library (glibc) vulnerabilities. Remote attackers can exploit them to cause the application to enter into an infinite loop.

Vulnerability Details

CVEID: CVE-2014-8121**
DESCRIPTION:** GNU C Library (glibc) is vulnerable to a denial of service, caused by the failure to properly check if a file is open by DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS). By performing a look-up on a database while iterating over it, an attacker could exploit this vulnerability to cause the application to enter into an infinite loop.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/102652 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

Affected Products and Versions

IBM SmartCloud Entry 2.2.0 through 2.2.0.3 Appliance fix pack 3
IBM SmartCloud Entry 2.3.0 through 2.3.0.3 Appliance fix pack 3
IBM SmartCloud Entry 2.4.0 through 2.4.0.3 Appliance fix pack 3
IBM SmartCloud Entry 3.1.0 through 3.1.0.4 Appliance fix pack 17
IBM SmartCloud Entry 3.2.0 through 3.2.0.4 Appliance fix pack 17

Remediation/Fixes