NULL pointer dereference in AdvanceCOMP - CVE-2019-8379

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31156

NULL pointer dereference in AdvanceCOMP - CVE-2019-8379

Published: February 17, 2019 / Updated: July 17, 2020


Vulnerability identifier: #VU31156
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-8379
CWE-ID: CWE-476
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file. A remote attacker can perform a denial of service (DoS) attack.


Affected software

AdvanceCOMP
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Power, little endian
Ubuntu
Fedora
advancecomp (Ubuntu package)
advancecomp (Red Hat package)
advancecomp

How to mitigate CVE-2019-8379

Update to version 2.1.

AdvanceCOMP - update to 2.1
advancecomp (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 2.1-1ubuntu0.18.04.2
advancecomp (Red Hat package) - update to 1.15-21.el7
advancecomp - update to 2.1-11.fc30

External References

Related Security Bulletins