PT-2023-7022 · Unknown+1 · Open Babel+1

Claudio Bozzato · Published 2023-07-21 · Updated 2023-07-27 · CVE-2022-46293

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Open Babel versions 3.1.1 and master commit 530dbfa3

Description The issue is related to out-of-bounds write vulnerabilities in the translationVectors parsing functionality, which can be triggered by a specially-crafted malformed file. This can lead to arbitrary code execution. The vulnerability affects the MOPAC file format, specifically inside the Final Point and Derivatives section. An attacker can exploit this by providing a malicious file.

Recommendations For Open Babel version 3.1.1, consider disabling the translationVectors parsing functionality until a patch is available. For Open Babel master commit 530dbfa3, restrict access to the MOPAC file format to minimize the risk of exploitation. Avoid using the translationVectors parsing functionality in the affected formats until the issue is resolved.

Exploit

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-119

Related Identifiers

BDU:2023-08043

CVE-2022-46293

Affected Products

Debian

Open Babel

References · 11

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2022-1666 · Exploit
• https://osv.dev/vulnerability/CVE-2022-46293 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08043 · Security Note
• https://ubuntu.com/security/CVE-2022-46293 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46293 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-46293 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-46293 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-46293 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-46293 · Vendor Advisory
• https://t.me/cvenotify/54915 · Telegram Post
• https://t.me/cvenotify/54949 · Telegram Post