TeX Live prior 2018-09-21 Type 1 Font writet1.c memory corruption

Summaryinfo

A vulnerability described as critical has been identified in TeX Live. The affected element is an unknown function of the file writet1.c of the component Type 1 Font Handler. The manipulation results in memory corruption. This vulnerability is identified as CVE-2018-17407. The attack is only possible with local access. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as critical has been found in TeX Live. Affected is an unknown code block of the file writet1.c of the component Type 1 Font Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.

The bug was discovered 09/19/2018. The weakness was released 09/23/2018 (Website). The advisory is shared for download at github.com. This vulnerability is traded as CVE-2018-17407 since 09/23/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 117674 (Debian DSA-4299-1 : texlive-bin - security update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 197274 (Ubuntu Security Notification for Texlive-bin Vulnerabilities (USN-3788-1)).

Upgrading to version 2018-09-21 eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (117674). Entry connected to this vulnerability is available at VDB-105747. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• TeX Live

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion