SB2017102717 - Multiple vulnerabilities in Radare radare2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017102717

SB2017102717 - Multiple vulnerabilities in Radare radare2

Published: October 27, 2017 Updated: August 8, 2020

Security Bulletin ID SB2017102717
Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 67% Medium 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2017-16805)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted ELF file, related to r_bin_dwarf_parse_comp_unit in dwarf.c and sdb_set_internal in shlr/sdb/src/sdb.c.


2) Buffer overflow (CVE-ID: CVE-2017-16357)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In radare 2.0.1, a memory corruption vulnerability exists in store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c, as demonstrated by an invalid free. This error is due to improper sh_size validation when allocating memory.


3) Out-of-bounds read (CVE-ID: CVE-2017-16358)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In radare 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when doing a string search.


4) NULL pointer dereference (CVE-ID: CVE-2017-16359)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

In radare 2.0.1, a pointer wraparound vulnerability exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c.


5) Out-of-bounds read (CVE-ID: CVE-2017-15931)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verneed() in libr/bin/format/elf/elf.c via crafted ELF files on 32bit systems.


6) Out-of-bounds read (CVE-ID: CVE-2017-15932)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

In radare2 2.0.1, an integer exception (negative number leading to an invalid memory access) exists in store_versioninfo_gnu_verdef() in libr/bin/format/elf/elf.c via crafted ELF files when parsing the ELF version on 32bit systems.


Remediation

Install update from vendor's website.

References