PT-2019-14879 · Nsa · Nsa Ghidra

Purpleracc00N · Published 2019-09-28 · Updated 2019-10-04 · CVE-2019-16941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NSA Ghidra versions prior to 9.0.5

Description The issue allows for arbitrary code execution when the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document, specifically in the context of the Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java file. This can occur when an XML document, originally created by DumpFunctionPatternInfoScript, is directly modified by an attacker to execute malicious code, such as making a java.lang.Runtime.exec call.

Recommendations For NSA Ghidra versions prior to 9.0.5, update to version 9.0.5 or later to resolve the issue. As a temporary workaround, consider disabling the experimental mode or restricting the use of the Read XML Files feature in Bit Patterns Explorer until a patch is applied. Avoid using modified XML documents with the Bit Patterns Explorer feature until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2019-16941

Affected Products

Nsa Ghidra

References · 8

• 🔥 https://github.com/NationalSecurityAgency/ghidra/issues/1090 · Exploit
• 🔥 https://github.com/purpleracc00n/CVE-2019-16941 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-16941 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16941 · Vendor Advisory
• https://github.com/NationalSecurityAgency/ghidra/commit/a17728f8c12effa171b17a25ccfb7e7d9528c5d0 · Note
• https://github.com/NationalSecurityAgency/ghidra/blob/79d8f164f8bb8b15cfb60c5d4faeb8e1c25d15ca/Ghidra/Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java#L187-L188 · Note
• https://twitter.com/NSAGov/status/1178812792159248385 · Note
• https://symantec.com/security-center/vulnerabilities/writeup/110223?om_rssid=sr-advisories · Note