PT-2017-15531 · National Instruments · Labview

Published 2017-09-05 · Updated 2022-04-19 · CVE-2017-2779

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabVIEW versions 2014 through 2017

Description A memory corruption issue exists in the RSRC segment parsing functionality. This can be triggered by a specially crafted Virtual Instrument (VI) file, causing an attacker-controlled looping condition that results in an arbitrary null write. An attacker-controlled VI file can potentially lead to code execution.

Recommendations For LabVIEW 2014, update to a version that includes the fix for this issue. For LabVIEW 2015, update to a version that includes the fix for this issue. For LabVIEW 2016, update to a version that includes the fix for this issue. For LabVIEW 2017, update to a version that includes the fix for this issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-2779

Affected Products

Labview

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0273 · Exploit
• 🔥 https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html · Exploit
• https://osv.dev/vulnerability/CVE-2017-2779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2779 · Security Note
• http://ni.com/product-documentation/54099/en · Vendor Advisory
• http://securityfocus.com/bid/100519 · Note