Input validation error in gSOAP - CVE-2017-9765
Published: July 20, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU32076
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-9765
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows remote attackers to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy.
Affected software
gSOAP
gsoap (Alpine package)
gsoap
Fedora
Dell EMC NetWorker vProxy
gsoap (Alpine package)
gsoap
Fedora
Dell EMC NetWorker vProxy
How to mitigate CVE-2017-9765
Update to version 2.8.48.
gSOAP - update to 2.8.48
gsoap (Alpine package) - update to 2.8.50-r0
gsoap - addressed in versions 2.7.16-5.el6, 2.8.16-9.el7, 2.8.30-2.fc25, 2.8.43-2.fc26
Dell EMC NetWorker vProxy - update to 19.9.0.2
gsoap (Alpine package) - update to 2.8.50-r0
gsoap - addressed in versions 2.7.16-5.el6, 2.8.16-9.el7, 2.8.30-2.fc25, 2.8.43-2.fc26
Dell EMC NetWorker vProxy - update to 19.9.0.2
External References
- http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions
- http://blog.senr.io/devilsivy.html
- http://www.securityfocus.com/bid/99868
- https://bugzilla.redhat.com/show_bug.cgi?id=1472807
- https://bugzilla.suse.com/show_bug.cgi?id=1049348
- https://www.genivia.com/advisory.html#Security_advisory:_CVE-2017-9765_bug_in_certain_versions_of_gSOAP_2.7_up_to_2.8.47_%28June_21,_2017%29
- https://www.genivia.com/changelog.html#Version_2.8.48_upd_%2806/21/2017%29