PT-2017-15531 · National Instruments · Labview

Publicado 2017-09-05 · Atualizado 2022-04-19 · CVE-2017-2779

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabVIEW versions 2014 through 2017

Description A memory corruption issue exists in the RSRC segment parsing functionality. This can be triggered by a specially crafted Virtual Instrument (VI) file, causing an attacker-controlled looping condition that results in an arbitrary null write. An attacker-controlled VI file can potentially lead to code execution.

Recommendations For LabVIEW 2014, update to a version that includes the fix for this issue. For LabVIEW 2015, update to a version that includes the fix for this issue. For LabVIEW 2016, update to a version that includes the fix for this issue. For LabVIEW 2017, update to a version that includes the fix for this issue.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2017-2779

Produtos afetados

Labview

Referências · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0273 · Exploit
• 🔥 https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-2779 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2779 · Nota de Segurança
• http://securityfocus.com/bid/100519 · Nota
• http://ni.com/product-documentation/54099/en · Aviso do Fabricante