Summary

Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.

Products Affected

• The underlying OS used by Brocade ASCG OVA releases prior to v3.0 are exposed.

Products Confirmed Not Affected

• Brocade SANnav
• Brocade Fabric OS

Solution

Brocade has released security updates that address the vulnerability described in this advisory:

• Brocade ASCG OVA releases v3.0 and later 

Brocade Customers should obtain the security updates through their usual update channels.

Notes

• Although Brocade Fabric OS is not affected, a security update is provided in Brocade Fabric OS v9.1.0 to prevent security scanners from reporting false positives.

Credit

The issue was found during internal security testing.

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.