Vulnerability Description
nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introduced in glibc 2.15 when the cache was added to nscd. This vulnerability is only present in the nscd binary.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Glibc | >= 2.15, < 2.40 |
| Debian | Debian Linux | 10.0 |
| Netapp | H300S Firmware | - |
| Netapp | H300S | - |
| Netapp | H500S Firmware | - |
| Netapp | H500S | - |
| Netapp | H700S Firmware | - |
| Netapp | H700S | - |
| Netapp | H410S Firmware | - |
| Netapp | H410S | - |
| Netapp | H410C Firmware | - |
| Netapp | H410C | - |
| Netapp | Hci Bootstrap Os | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2024/07/22/5Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240524-0011/Third Party Advisory
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005Broken Link
- http://www.openwall.com/lists/oss-security/2024/07/22/5Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/06/msg00026.htmlMailing ListThird Party Advisory
- https://security.netapp.com/advisory/ntap-20240524-0011/Third Party Advisory
- https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005Broken Link
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
FAQ
What is CVE-2024-33599?
CVE-2024-33599 is a vulnerability with a CVSS score of 8.1 (HIGH). nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may r...
How severe is CVE-2024-33599?
CVE-2024-33599 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-33599?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Glibc, Debian Debian Linux, Netapp H300S Firmware, Netapp H300S, Netapp H500S Firmware.