PT-2017-4298 · Gnu · Gnu Binutils

Published 2017-09-26 · Updated 2019-10-03 · CVE-2017-14933

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: GNU Binutils version 2.29

Description: The issue is related to the read formatted entries function in the dwarf2.c component of GNU Binutils. It involves an infinite loop due to an unreachable exit condition. This can be exploited by a remote attacker using a specially crafted ELF file, leading to a denial of service.

Recommendations: For GNU Binutils version 2.29, consider disabling the read formatted entries function in the dwarf2.c component as a temporary workaround until a patch is available. Restrict access to the dwarf2.c component to minimize the risk of exploitation. Avoid using specially crafted ELF files with the affected read formatted entries function until the issue is resolved.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2023-07753

CVE-2017-14933

Affected Products

Gnu Binutils

References · 16

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-14933 · Vendor Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=22210 · Patch
• https://bdu.fstec.ru/vul/2023-07753 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-14933 · Security Note
• https://osv.dev/vulnerability/CVE-2017-14933 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-14933 · Security Note
• https://ubuntu.com/security/CVE-2017-14933 · Vendor Advisory
• https://security.gentoo.org/glsa/201811-17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-14933 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-14933 · Vendor Advisory
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git%3Bh=33e0a9a056bd23e923b929a4f2ab049ade0b1c32 · Note
• http://securityfocus.com/bid/101203 · Note
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=33e0a9a056bd23e923b929a4f2ab049ade0b1c32 · Note
• https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=30d0157a2ad64e64e5ff9fcc0dbe78a3e682f573 · Note