PT-2023-18387 · Unknown · Velociraptor

B1Tg · Publicado 2023-04-21 · Atualizado 2023-05-03 · CVE-2023-2226

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.6.8

Description The issue is caused by insufficient validation in the PE and OLE parsers, allowing an attacker to crash Velociraptor during parsing of maliciously malformed files. For this attack to succeed, the attacker needs to introduce malicious files to the system while Velociraptor attempts to collect artifacts that parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart, and it will still be possible to collect other artifacts.

Recommendations For versions prior to 0.6.8, update to version 0.6.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the system to prevent the introduction of malicious files while Velociraptor is collecting artifacts.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2023-2226

Produtos afetados

Velociraptor

Referências · 4

• https://github.com/Velocidex/velociraptor · Nota
• https://t.me/cibsecurity/62597 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2226 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-2226 · Nota de Segurança