Buffer overflow in YARA - CVE-2021-45429

Vulnerability identifier: #VU98812

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-45429

CWE-ID: CWE-120

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the yr_set_configuration() function in yara/libyara/libyara.c. A remote attacker can trick the victim into loading a specially crafted file and crash the application.

YARA
IBM Qradar SIEM
Fedora
Ubuntu
libyara8 (Ubuntu package)
yara (Ubuntu package)
python-yara
yara
IBM QRadar Incident Forensics

Install updates from vendor's website.

YARA - update to 4.2.0
IBM Qradar SIEM - update to 7.5.0 Update Pack 10
libyara8 (Ubuntu package) - update to Ubuntu Pro
yara (Ubuntu package) - addressed in versions Ubuntu Pro, 3.4.0+dfsg-2ubuntu0.1~esm1, 3.7.1-1ubuntu2+esm1, 3.9.0-1ubuntu0.1~esm1
python-yara - update to 4.2.3-1.el8
yara - update to 4.2.3-1.el8
IBM QRadar Incident Forensics - update to 7.5.0.10

• https://github.com/VirusTotal/yara/issues/1616

• Denial of service in VirusTotal YARA
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in QRadar Incident Forensics
• Fedora EPEL 8 update for python-yara, yara
• Ubuntu update for yara
• Ubuntu update for yara