Summaryinfo

A vulnerability was found in Geutebrueck GCore 1.3.8.42/1.4.2.37. It has been declared as critical. Impacted is an unknown function of the file GCoreServer.exe of the component URI Handler. Executing a manipulation as part of GET Request can lead to memory corruption. This vulnerability is tracked as CVE-2017-11517. The attack can be launched remotely. Moreover, an exploit is present. The application of restrictive firewalling is recommended.

Detailsinfo

A vulnerability was found in Geutebrueck GCore 1.3.8.42/1.4.2.37. It has been declared as critical. This vulnerability affects some unknown processing of the file GCoreServer.exe of the component URI Handler. The manipulation as part of a GET Request leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request.

The bug was discovered 01/24/2017. The weakness was disclosed 07/21/2017 as EDB-ID 41153 as not defined exploit (Exploit-DB). The advisory is available at exploit-db.com. This vulnerability was named CVE-2017-11517 since 07/21/2017. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details and also a public exploit are known.

After immediately, there has been an exploit disclosed. It is possible to download the exploit at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 178 days. During that time the estimated underground price was around $0-$5k.

Proper firewalling of is able to address this issue.

The vulnerability is also documented in the vulnerability database at Exploit-DB (41153). The entry VDB-96252 is pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Geutebrueck

Name

• GCore

Version

• 1.3.8.42
• 1.4.2.37

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion