Summaryinfo

A vulnerability, which was classified as critical, was found in GNU binutils up to 2.29. This issue affects the function bfd_vms_save_sized_string of the file vms-misc.c of the component libbfd. Such manipulation leads to out-of-bounds. This vulnerability is traded as CVE-2017-12449. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in GNU binutils up to 2.29 (Programming Tool Software). Affected by this issue is the function bfd_vms_save_sized_string of the file vms-misc.c of the component libbfd. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read via a crafted vms file.

The bug was discovered 07/26/2017. The weakness was shared 08/04/2017 (Website). The advisory is available at sourceware.org. This vulnerability is handled as CVE-2017-12449 since 08/04/2017. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 9 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277638 (Fedora Security Update for binutils (FEDORA-2019-ba3cbcfd20)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 100499†). The entries VDB-104833, VDB-104835, VDB-104836 and VDB-104837 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Tool Software

Vendor

• GNU

Name

• binutils

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion