PT-2014-8564 · Gnu+6 · Gnu Binutils+6

Publicado 2014-01-15 · Atualizado 2018-01-03 · CVE-2014-8501

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU binutils versions 2.24 and earlier

Description The issue allows remote attackers to cause a denial of service (out-of-bounds write) and possibly have other unspecified impact via a crafted NumberOfRvaAndSizes field in the AOUT header in a PE executable. This is due to the bfd XXi swap aouthdr in function in bfd/peXXigen.c.

Recommendations For GNU binutils versions 2.24 and earlier, consider updating to a newer version to mitigate the risk. As a temporary workaround, restrict the use of the bfd XXi swap aouthdr in function in bfd/peXXigen.c to minimize the risk of exploitation. Avoid using crafted NumberOfRvaAndSizes fields in the AOUT header in PE executables until the issue is resolved.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2014-1061

ALT-PU-2016-1015

CESA-2015_2079

CVE-2014-8501

DLA-184-1

DSA-3123-1

DSA-3123-2

ECHO-418F-AAAE-0CBD

MGASA-2015-0027

MGASA-2018-0034

RHSA-2015:2079

RHSA-2015_2079

USN-2496-1

USN-3367-1

Produtos afetados

Alt Linux

Centos

Debian

Gnu Binutils

Red Hat

Suse

Ubuntu

Referências · 58

• 🔥 https://sourceware.org/bugzilla/show_bug.cgi?id=17512 · Exploit
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=7e1e19887abd24aeb15066b141cdff5541e0ec8e · Nota
• http://secunia.com/advisories/62241 · Nota
• https://osv.dev/vulnerability/DSA-3123-2 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148427.html · Aviso do Fabricante
• https://security.gentoo.org/glsa/201612-24 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8485 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8503 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/10/26/3 · Nota
• http://secunia.com/advisories/62746 · Nota
• https://osv.dev/vulnerability/DSA-3123-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3367-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-8737 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-4488 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2496-1 · Aviso do Fabricante