PT-2017-4307 · Gnu+1 · Gnu Binutils+1

Publicado

2017-09-22

·

Atualizado

2021-07-21

·

CVE-2017-15024

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29
Description: The issue is related to the find abstract instance name function in the dwarf2.c component of the GNU Binutils. It allows a remote attacker to cause a denial of service by executing an infinite recursion, leading to an application crash. This can be achieved through a specially crafted ELF file.
Recommendations: For GNU Binutils version 2.29, consider updating to a newer version that contains a fix for this issue. As a temporary workaround, restrict the use of the find abstract instance name function in the dwarf2.c component to minimize the risk of exploitation. Avoid processing untrusted ELF files until the issue is resolved.

Correção

DoS

Infinite Loop

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

BDU:2023-07762
CVE-2017-15024
MGASA-2019-0169
USN-4336-2

Produtos afetados

Gnu Binutils
Ubuntu