Denial of Service Vulnerability in Binutils Package: CVE-2017-14333
Summary
UBUNTU-CVE-2017-14333: The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impac... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Binutils package is a collection of binary tools essential for the development and management of software on Unix-like operating systems. It includes tools such as 'as' (the assembler), 'ld' (the linker), and 'readelf' (for inspecting ELF files). This package is widely used in software development, making its security paramount. The vulnerability CVE-2017-14333 affects the 'readelf' tool, which can process binary files, potentially leading to severe consequences if exploited.
Vulnerability Detail
The vulnerability arises from the process_version_sections function in readelf.c within GNU Binutils version 2.29. Attackers can exploit this vulnerability by crafting a binary file with invalid values for ent.vn_next, leading to an integer overflow. This can cause a denial of service, resulting in the application hanging due to a time-consuming loop, and may also allow for unspecified other impacts. The CVSS score for this vulnerability is 7.8, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the 'readelf -a' command on untrusted binary files until the package is updated to the patched version. This reduces the risk of triggering the vulnerability.
Conclusion
CVE-2017-14333 is a significant vulnerability in the Binutils package that can lead to denial of service through the readelf tool. It is essential for users to update to the patched version to secure their systems. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-14333 is a vulnerability in the Binutils package that can lead to denial of service due to an integer overflow in the readelf tool.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploiting this vulnerability can lead to a denial of service, causing the application to hang and potentially allowing for other unspecified impacts.
Yes, a patched version of the Binutils package is available. Users should update to version 2.26.1-1ubuntu1~16.04.8+esm1 to mitigate the risk.
If immediate updates are not possible, avoid using the 'readelf -a' command on untrusted binary files to minimize exposure to the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
