Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.9

glibc and related Linux packages can be crashed by a local user

CVE-2003-0859 · published 22 years ago
Summary

The getifaddrs function in older versions of the GNU C library (up to version 2.2.4) can be tricked by a user who is already logged in on the machine to send fake messages that confuse the kernel’s netlink interface. This can make the affected programs stop working and may require a restart. Updating the library and any software that uses it (such as zebra, Quagga routing suite, SGI ProPack, and Red Hat Enterprise Linux) to a newer version resolves the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gnu glibc 2.3.2
cpe:2.3:a:gnu:glibc:2.3.2:*:*:*:*:*:*:*
gnu zebra 0.91a
0.92a
0.93a
0.93b
cpe:2.3:a:gnu:zebra:0.91a:*:*:*:*:*:*:*
quagga quagga_routing_software_suite 0.96.2
cpe:2.3:a:quagga:quagga_routing_software_suite:0.96.2:*:*:*:*:*:*:*
sgi propack 2.2.1
2.3
cpe:2.3:a:sgi:propack:2.2.1:*:*:*:*:*:*:*
redhat enterprise_linux 2.1
3.0
cpe:2.3:o:redhat:enterprise_linux:2.1:*:advanced_server:*:*:*:*:*
redhat linux_advanced_workstation 2.1
cpe:2.3:o:redhat:linux_advanced_workstation:2.1:*:itanium_processor:*:*:*:*:*
intel ia64 All versions
cpe:2.3:h:intel:ia64:*:*:*:*:*:*:*:*
Original advisory text
The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
The getifaddrs function in GNU libc (glibc) 2.2.4 and earlier allows local users to cause a denial of service by sending spoofed messages as other users to the kernel netlink interface.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.9 Medium
Exploitation
<1% chance of attack within 30 days
Timeline
Published15 Dec 2003
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2003-0859 · NVD
Track software like this
Free during beta