Buffer overflow in libraw (Alpine package)

1) Buffer overflow

EUVDB-ID: #VU32072

Risk: Low

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-6887

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

A boundary error within the "parse_tiff_ifd()" function (internal/dcraw_common.cpp) in LibRaw versions before 0.18.2 can be exploited to cause a memory corruption via e.g. a specially crafted KDC file with model set to "DSLR-A100" and containing multiple sequences of 0x100 and 0x14A TAGs.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libraw (Alpine package): 0.17.2-r0

CPE2.3

• cpe:2.3:a:alpine:libraw_alpine_package:0.17.2-r0:*:*:*:*:alpine_linux:*:3.2

External links

https://git.alpinelinux.org/aports/commit/?id=8b4b58dd7e4fd4fad6f16536acd72466ec47f118
https://git.alpinelinux.org/aports/commit/?id=8ee017bc9e06c22479f4c311c1cf02bc4aeb3324
https://git.alpinelinux.org/aports/commit/?id=a725820240e9ab494a6a4ae649c35ad5889a3b4d
https://git.alpinelinux.org/aports/commit/?id=a86993dfa8438cf7d5befd0fea534d6e0b00cbee

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.