#VU17823 Out-of-bounds read in file
Vulnerability identifier: #VU17823
Vulnerability risk: Low
CVSSv3.1: 4.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L/E:P/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-125
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
file
Universal components / Libraries /
Libraries used by multiple products
Vendor: Ian F. Darwin
Description
The vulnerability allows a remote attacker to obtain potentially sensitive information or perform a denial of service (DoS) attack.
The vulnerability exists due to out-of-bounds read in the do_core_note function. A remote attacker can trick the victim into executing a file that submits malicious input to the targeted system with the file command, trigger memory corruption and gain access to arbitrary data or perform a denial of service attack.
Mitigation
Update to version 5.36.
Vulnerable software versions
file: 5.35
External links
http://bugs.astron.com/view.php?id=64
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
