PT-2017-4299 · Gnu · Gnu Binutils

Publicado 2017-09-27 · Atualizado 2019-10-03 · CVE-2017-14934

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the process debug info function in the dwarf.c component of GNU Binutils, which is caused by an incorrect buffer size calculation. This allows a remote attacker to cause a denial of service, specifically an infinite loop, by using a specially crafted ELF file that contains a negative size value in a CU structure.

Recommendations: For GNU Binutils version 2.29, consider disabling the process debug info function in the dwarf.c component as a temporary workaround until a patch is available. Restrict access to the dwarf.c component to minimize the risk of exploitation. Avoid using the process debug info function with untrusted ELF files until the issue is resolved.

Correção

Infinite Loop

Enumeração de Fraquezas

CWE-131

CWE-835

Identificadores relacionados

BDU:2023-07754

CVE-2017-14934

Produtos afetados

Gnu Binutils

Referências · 13

• https://cve.org/CVERecord?id=CVE-2017-14934 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14934 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-07754 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-14934 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-14934 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14934 · Aviso do Fabricante
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=19485196044b2521af979f1e5c4a89bfb90fba0b · Nota
• https://sourceware.org/bugzilla/show_bug.cgi?id=22219 · Correção
• https://osv.dev/vulnerability/CVE-2017-14934 · Aviso do Fabricante
• http://securityfocus.com/bid/101204 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14934 · Nota de Segurança
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Aviso do Fabricante
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=19485196044b2521af979f1e5c4a89bfb90fba0b · Nota