Critical Out of Bounds Read Vulnerability in Binutils Package
Summary
UBUNTU-CVE-2017-12449: The _bfd_vms_save_sized_string function in vms-misc.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29 and earlier, allows remote attackers to cause an out of bounds heap read... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Binutils is a collection of binary tools essential for managing binary files, object files, and libraries in various programming environments. It provides functionalities such as linking, assembling, and disassembling, making it a crucial component for developers working with compiled languages. This package is widely used in Unix-like operating systems, including Ubuntu. The vulnerability in question affects versions of Binutils up to 2.29, allowing attackers to exploit the library's functions, leading to potential data exposure.
Vulnerability Detail
The vulnerability, identified as CVE-2017-12449, originates from the _bfd_vms_save_sized_string function in the Binary File Descriptor (BFD) library. It allows remote attackers to perform an out-of-bounds heap read by crafting a malicious VMS file. This can lead to unauthorized access to sensitive data, potentially compromising the integrity and confidentiality of the system. The severity of this vulnerability is rated with a CVSS score of 7.8, indicating a high risk level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted VMS files until the package is updated. This reduces the risk of exploitation while waiting for a permanent fix.
Conclusion
The CVE-2017-12449 vulnerability in the Binutils package poses a significant risk due to its potential for remote exploitation. Users are strongly advised to update their systems to the latest patched versions to safeguard against this vulnerability. Regular monitoring and updates are essential to maintain system security.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-12449 is a vulnerability in the Binutils package that allows remote attackers to perform an out-of-bounds heap read via a crafted VMS file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, potentially compromising system integrity and confidentiality.
Yes, patched versions of the Binutils package are available. Users should update to the specified versions to mitigate the risk.
The CVSS score of CVE-2017-12449 is 7.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
