Heap-Based Buffer Over-Read Vulnerability in LibOFX 0.9.12
Summary
CVE-2017-14731: ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an ofxdump call. Affects libofx across 2 version ranges.
< 1:0.9.11-5
< c426e22d808055a6645a83f219fff1684dd1ac79
Fixed in 1:0.9.11-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LibOFX is an open-source library designed for reading and writing Open Financial Exchange (OFX) files. It provides a standardized way for financial data exchange, making it easier for users to manage their financial information. The library is widely used in various applications that require integration with financial institutions. However, version 0.9.12 of LibOFX contains a vulnerability that can lead to denial of service due to improper handling of crafted files.
Vulnerability Detail
The vulnerability, identified as CVE-2017-14731, originates from the 'ofx_proc_file' function in 'ofx_preproc.cpp'. It allows remote attackers to exploit a heap-based buffer over-read, potentially causing the application to crash. This issue arises when the library processes specially crafted OFX files, leading to a denial of service. The technical implications include the possibility of application instability and service interruption, which can affect users relying on financial data processing.
How To Fix
Minimum fixed version
1:0.9.11-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libofxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider implementing input validation to check the integrity of OFX files before processing them. This can help mitigate the risk of processing malicious files.
Conclusion
CVE-2017-14731 is a significant vulnerability in LibOFX 0.9.12 that can lead to denial of service through crafted OFX files. It is crucial to update to a patched version to ensure the stability and security of applications relying on this library. Implementing workarounds such as input validation can provide temporary relief until an update is feasible.
See every vulnerability recorded for libofx →
FAQ
CVE-2017-14731 is a vulnerability in LibOFX 0.9.12 that allows remote attackers to cause a denial of service through a crafted OFX file.
If your application uses LibOFX 0.9.12, it may crash or become unstable when processing malicious OFX files, leading to service interruptions.
The CVSS score for CVE-2017-14731 is 6.5, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, implement input validation to ensure that OFX files are checked for integrity before processing.
Related vulnerabilities
Recent vulnerabilities recorded for libofx.
