SB2018122308 - Information disclosure in VirusTotal YARA

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2018-19975)

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the design of the YARA virtual machine (VM), which could allow an attacker to use OP_COUNT to read a DWORD value from any arbitrary memory address. A local attacker can execute a compiled rule file that submits malicious input and read data from any arbitrary address in memory, in libyara/exec.c.

2) Information disclosure (CVE-ID: CVE-2018-19974)

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the design of the YARA virtual machine (VM). A local attacker can execute a compiled rule file that submits malicious input and read uninitialized data from VM scratch memory in libyara/exec.c.

3) Information disclosure (CVE-ID: CVE-2018-19976)

The vulnerability allows a local attacker to gain access to potentially sensitive information.

The vulnerability exists due to the design of the YARA virtual machine. A local attacker can execute a compiled rule file that submits malicious input and read uninitialized data from VM scratch memory in libyara/exec.c.

Remediation

Install update from vendor's website.

References

• https://github.com/VirusTotal/yara/issues/999