Vulnerability Report

CVE-2017-1000366

Title: Mcafee Web Gateway Memory Corruption

Memory Corruption

Proof Of Concept

PoC Available for CVE-2017-1000366

CWE Category CWE-119

Published Date Jun 19, 2017

Modified Date Jun 17, 2026

Exploit Status Available

Score 7.8 CVSS v3.0

Exploit Probability (EPSS)

2.73%

Vulnerability Summary

CVE-2017-1000366: glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code execution. Please note that additional hardening changes have been made to glibc to prevent manipulation of stack and heap memory but these issues are not directly exploitable, as such they have not been given a CVE. This affects glibc 2.25 and earlier.

Impacted Vendors

Reference Links

http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html http://seclists.org/fulldisclosure/2019/Sep/7 http://www.debian.org/security/2017/dsa-3887 http://www.securityfocus.com/bid/99127 http://www.securitytracker.com/id/1038712 https://access.redhat.com/errata/RHSA-2017:1479 https://access.redhat.com/errata/RHSA-2017:1480 https://access.redhat.com/errata/RHSA-2017:1481 https://access.redhat.com/errata/RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1712 https://access.redhat.com/security/cve/CVE-2017-1000366 https://kc.mcafee.com/corporate/index?page=content&id=SB10205 https://seclists.org/bugtraq/2019/Sep/7 https://security.gentoo.org/glsa/201706-19 https://www.exploit-db.com/exploits/42274/ https://www.exploit-db.com/exploits/42275/ https://www.exploit-db.com/exploits/42276/ https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://www.suse.com/security/cve/CVE-2017-1000366/ https://www.suse.com/support/kb/doc/?id=7020973 http://packetstormsecurity.com/files/154361/Cisco-Device-Hardcoded-Credentials-GNU-glibc-BusyBox.html http://seclists.org/fulldisclosure/2019/Sep/7 http://www.debian.org/security/2017/dsa-3887 http://www.securityfocus.com/bid/99127 http://www.securitytracker.com/id/1038712 https://access.redhat.com/errata/RHSA-2017:1479 https://access.redhat.com/errata/RHSA-2017:1480 https://access.redhat.com/errata/RHSA-2017:1481 https://access.redhat.com/errata/RHSA-2017:1567 https://access.redhat.com/errata/RHSA-2017:1712 https://access.redhat.com/security/cve/CVE-2017-1000366 https://kc.mcafee.com/corporate/index?page=content&id=SB10205 https://seclists.org/bugtraq/2019/Sep/7 https://security.gentoo.org/glsa/201706-19 https://www.exploit-db.com/exploits/42274/ https://www.exploit-db.com/exploits/42275/ https://www.exploit-db.com/exploits/42276/ https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt https://www.suse.com/security/cve/CVE-2017-1000366/ https://www.suse.com/support/kb/doc/?id=7020973

CVSS v3.0

Source Entity [email protected]

Severity HIGH

7.8

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

Source Entity [email protected]

Severity HIGH

7.2

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2017-1000366 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/42274

View Code

Exploit-DB https://www.exploit-db.com/exploits/42276

View Code

Exploit-DB https://www.exploit-db.com/exploits/42275

View Code

June 17, 2026 MODIFIED