PT-2017-4297 · Gnu+1 · Gnu Binutils+2

Published 2017-09-25 · Updated 2021-07-21 · CVE-2017-14932

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the decode line info function in the dwarf2.c component of the Binary File Descriptor (BFD) library, also known as libbfd. It allows remote attackers to cause a denial of service by creating an infinite loop using a crafted ELF file. This can be exploited by a remote attacker to disrupt service.

Recommendations: For GNU Binutils version 2.29, consider disabling the decode line info function in dwarf2.c as a temporary workaround until a patch is available. Restrict access to the libbfd library to minimize the risk of exploitation. Avoid using crafted ELF files that could trigger the infinite loop in the decode line info function.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-07752

CVE-2017-14932

USN-4336-2

Affected Products

Gnu Binutils

Ubuntu

Libbfd

References · 456

• https://ubuntu.com/security/CVE-2016-4492 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9744 · Security Note
• https://ubuntu.com/security/CVE-2016-4487 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17360 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00670 · Security Note
• https://ubuntu.com/security/CVE-2017-14130 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17794 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14940 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17985 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7209 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9751 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19931 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17121 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7209 · Security Note