Remote code execution in MarkLogic

1) Heap-based buffer overflow

EUVDB-ID: #VU6502

Risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2016-8383

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow in the Doc_GetFontTable functionality of AntennaHouse DMC HTMLFilter when handling malicious .doc files. A remote attacker can create a specially crafted .doc file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Update to version 8.0-6.4.

Vulnerable software versions

MarkLogic: 8.0 (-5.5)

CPE2.3

• cpe:2.3:a:marklogic:marklogic:8.0 (-5.5):*:*:*:*:*:*:*

External links

https://www.talosintelligence.com/reports/TALOS-2016-0208/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.