Main Vulnerability Database Vulnerabilities #VU38820

Input validation error in OCaml - CVE-2017-9772

Published: June 23, 2017 / Updated: August 8, 2020

Vulnerability identifier: #VU38820

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9772

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

Affected software

OCaml
Gentoo Linux
Fedora
ocaml

How to mitigate CVE-2017-9772

Install update from vendor's website.

ocaml - update to 4.04.0-10.fc26

External References

http://www.securityfocus.com/bid/99277
https://caml.inria.fr/mantis/view.php?id=7557
https://security.gentoo.org/glsa/201710-07
https://sympa.inria.fr/sympa/arc/caml-list/2017-06/msg00094.html

Related Security Bulletins