PT-2017-4311 · Gnu+2 · Gnu Binutils+2
Publicado
2017-10-27
·
Atualizado
2024-06-15
·
CVE-2017-15996
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
GNU Binutils version 2.29
Description:
The issue is related to a buffer overflow in the elfcomm.c component of GNU Binutils, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted ELF file. This is associated with an uninitialized variable, an improper conditional jump, and the
get archive member name, process archive index and symbols, and setup archive functions. The exploitation can lead to excessive memory allocation.Recommendations:
For GNU Binutils version 2.29, consider disabling the
elfcomm.c component or restricting its use until a patch is available. As a temporary workaround, avoid using the readelf function with untrusted ELF files. Restrict access to the get archive member name, process archive index and symbols, and setup archive functions to minimize the risk of exploitation.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Gnu Binutils
Suse
Ubuntu