Unscored severity · published Oct 11, 2002
CVE-2002-1146
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size…
–
CVSS
3.3%
EPSS
No
On KEV
Description
The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, use the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glibc · Gnu
through 2.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-1146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-1146
distro.conectiva.com.br
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000535
Vendor Advisory
http://www.iss.net/security_center/static/10295.php
Third Party Advisory
http://www.kb.cert.org/vuls/id/738331
www.mandrakesoft.com
http://www.mandrakesoft.com/security/advisories?name=MDKSA-2004:009
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2002-197.html
More from Glibc
7.8
CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
9.8
CVE-2026-5450
scanf %mc off-by-one heap buffer overflow
9.8
CVE-2023-0687
A vulnerability was found in GNU C Library 2.38
9.8
CVE-2023-25139
sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size
9.8
CVE-2022-23218
The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating…