YARA 3.5.0 Regex libyara/re.c _yr_re_emit Rule recursion

Summaryinfo

A vulnerability described as problematic has been identified in YARA 3.5.0. Impacted is the function _yr_re_emit of the file libyara/re.c of the component Regex Handler. Such manipulation as part of Rule leads to denial of service. This vulnerability is documented as CVE-2017-9304. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in YARA 3.5.0 and classified as problematic. Affected by this issue is the function _yr_re_emit of the file libyara/re.c of the component Regex Handler. The manipulation as part of a Rule leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-674. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. Impacted is availability. CVE summarizes:

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.

The bug was discovered 05/29/2017. The weakness was released 05/31/2017 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2017-9304. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 101577 (Fedora 26 : yara (2017-156d12fa2f)), which helps to determine the existence of the flaw in a target environment. It is running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 276744 (Fedora Security Update for yara (FEDORA-2017-fa52efdf32)).

Upgrading eliminates this vulnerability. A possible mitigation has been published 2 months after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (101577). Entry connected to this vulnerability is available at VDB-102031. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• YARA

Version

• 3.5.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion