PT-2017-3250 · Gnu+1 · Libffi+1
CVE-2017-1000376
·
Publicado
2017-06-19
·
Atualizado
2023-09-22
CVSS v3.1
7.0
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libffi versions prior to 3.1
Description
The issue is caused by libffi requesting an executable stack, allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. This is due to a buffer overflow operation in memory, which can be exploited by a local attacker to execute arbitrary code on 32-bit x86 systems, specifically on the i386 architecture, by forcing the stack to be executable.
Recommendations
For libffi versions prior to 3.1, update to version 3.1 or later to resolve the issue. As a temporary workaround, consider disabling the executable stack feature until a patch is available. Restrict access to libffi on 32-bit x86 systems to minimize the risk of exploitation.
Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ubuntu
Libffi