SB2017040315 - Multiple vulnerabilities in VirusTotal YARA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017040315

SB2017040315 - Multiple vulnerabilities in VirusTotal YARA

Published: April 3, 2017 Updated: January 26, 2021

Security Bulletin ID SB2017040315
Severity
Medium
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 secuirty vulnerabilities.


1) Uncontrolled Recursion (CVE-ID: CVE-2017-9438)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule (involving hex strings) that is mishandled in the _yr_re_emit function, a different vulnerability than CVE-2017-9304.


2) Uncontrolled Recursion (CVE-ID: CVE-2017-9304)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.


3) Use-after-free (CVE-ID: CVE-2017-8929)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted rule. A remote attackers can cause a denial of service (use-after-free and application crash).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


4) Out-of-bounds read (CVE-ID: CVE-2017-8294)

The vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within the the regex component function in YARA 3.5.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted rule that is mishandled file. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger out-of-bounds read error and crash the affected application.


5) Out-of-bounds read (CVE-ID: CVE-2017-5923)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) via a crafted rule that is mishandled in the yara_yyparse function.


6) Use-after-free (CVE-ID: CVE-2017-5924)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted rule that is mishandled in the yr_compiler_destroy function. A remote attackers can cause a denial of service (use-after-free and application crash).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


7) NULL pointer dereference (CVE-ID: CVE-2016-10210)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a crafted rule that is mishandled in the yy_get_next_buffer function.


8) Use-after-free (CVE-ID: CVE-2016-10211)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing a crafted rule that is mishandled in the yr_parser_lookup_loop_variable function. A remote attackers can cause a denial of service (use-after-free and application crash).

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


Remediation

Install update from vendor's website.

References