Denial of service in VAMPSET - CVE-2017-7967
Published: May 18, 2017
Vulnerability identifier: #VU6603
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-7967
CWE-ID: CWE-120
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the target system.
The weakness exists due to buffer overflow when processing corrupted vf2 files. A local attacker can trigger memory corruption by using a vf2 file and cause the software to halt or not start when trying to open the corrupted file.
Successful exploitation of the vulnerability results in denial of service.
Affected software
VAMPSET
How to mitigate CVE-2017-7967
Update to version 2.2.191.