PT-2018-9280 · Mingw W64 · Mingw-W64

Dominik Maier · Published 2018-03-06 · Updated 2021-09-08 · CVE-2018-1000101

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mingw-w64 versions 5.0.3 and earlier, 5.0.4, 6.0.0, 7.0.0

Description: The issue is related to an Improper Null Termination in the mingw-w64-crt (libc) snprintf and (v)snprintf functions. This can lead to corruption of subsequent string functions. The attack appears to be exploitable via network, depending on usage, with the worst-case scenario being corruption.

Recommendations: For Mingw-w64 versions 5.0.3 and earlier: update to a version later than 5.0.3 to resolve the issue. For Mingw-w64 version 5.0.4: update to a version later than 5.0.4 to resolve the issue. For Mingw-w64 versions 6.0.0 and 7.0.0: update to a version later than 7.0.0 to resolve the issue. As a temporary workaround, consider restricting the use of the snprintf and (v)snprintf functions in mingw-w64-crt until a patch is available.

Fix

Related Identifiers

CVE-2018-1000101

Affected Products

Mingw-W64

References · 12

• https://osv.dev/vulnerability/CVE-2018-1000101 · Vendor Advisory
• https://sourceforge.net/p/mingw-w64/mingw-w64/ci/v5.x/tree/mingw-w64-crt/stdio/vsnprintf.c#l12 · Patch
• https://cve.org/CVERecord?id=CVE-2018-1000101 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1000101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000101 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000101 · Vendor Advisory
• https://sourceforge.net/p/mingw-w64/mingw-w64/ci/v5.x/tree/mingw-w64-crt/stdio/snprintf.c#l15 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000101 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000101 · Vendor Advisory
• https://sourceforge.net/p/mingw-w64/bugs/709/?limit=25#1d38/fefc/39aa · Note
• https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000101.json · Note
• https://sourceforge.net/p/mingw-w64/bugs/709 · Note