PT-2023-6730 · Unknown+1 · Open Babel+1

Claudio Bozzato · Published 2023-07-21 · Updated 2023-07-27 · CVE-2022-46292

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and prior

Description The issue is related to an out-of-bounds write vulnerability in the translationVectors parsing functionality of Open Babel, which can be exploited by a remote attacker using a specially crafted malformed file to achieve arbitrary code execution. This vulnerability affects the MOPAC file format, specifically inside the Unit Cell Translation section.

Recommendations For Open Babel version 3.1.1, consider disabling the translationVectors parsing functionality until a patch is available. Restrict access to the MOPAC file format, especially the Unit Cell Translation section, to minimize the risk of exploitation. Avoid using specially crafted malformed files that could trigger this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-07506

CVE-2022-46292

Affected Products

Debian

Open Babel

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666 · Exploit
• https://osv.dev/vulnerability/CVE-2022-46292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46292 · Security Note
• https://bdu.fstec.ru/vul/2023-07506 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46292 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46292 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-46292 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-46292 · Security Note
• https://ubuntu.com/security/CVE-2022-46292 · Vendor Advisory
• https://t.me/cvenotify/54941 · Telegram Post
• https://t.me/cvenotify/54917 · Telegram Post