SB2017051106 - Remote code execution in wolfSSL
Published: May 11, 2017
Security Bulletin ID
SB2017051106
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Out-of-bounds write (CVE-ID: CVE-2017-2800)
The vulnerability allows a remote unauthenticated attacker execute arbitrary code or cause DoS condition.The weakness exists due to improper parsing of X.509 certificates by wolfSSL library. A remote attacker can send specially crafted X.509 certificates, cause an out-of-bounds write by one condition in the wolfSSL_X509_NAME_get_text_by_NID function and execute arbitrary code or cause the application to crash.
Successful exploitation of the vulnerability may result in arbitrary code execution or denial of service.
Remediation
Install update from vendor's website.