Denial of Service Vulnerability in Binutils Package - CVE-2017-14938
Summary
UBUNTU-CVE-2017-14938: _bfd_elf_slurp_version_tables in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Binutils package is a collection of binary tools essential for the development and manipulation of binary files. It includes tools such as 'as' (the assembler), 'ld' (the linker), and 'objdump' (for examining object files). This package is widely used in various software development environments, making it critical for building and managing applications. However, it has been found to be vulnerable to a denial of service attack due to improper handling of crafted ELF files.
Vulnerability Detail
The vulnerability identified as CVE-2017-14938 exists in the Binary File Descriptor (BFD) library, specifically in the function _bfd_elf_slurp_version_tables within elf.c. This flaw allows remote attackers to exploit the library by providing a specially crafted ELF file, leading to excessive memory allocation and potentially causing the application to crash. The vulnerability poses a significant risk as it can disrupt services relying on the Binutils package, impacting software development and deployment processes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted ELF files with the Binutils tools until the package is updated to a secure version. This can help mitigate the risk of exploitation while a permanent fix is being applied.
Conclusion
CVE-2017-14938 is a significant vulnerability in the Binutils package that can lead to denial of service attacks. It is crucial for users to update their systems to the patched versions to mitigate the risks associated with this vulnerability. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-14938 is a vulnerability in the Binutils package that allows remote attackers to cause a denial of service through crafted ELF files.
This vulnerability can lead to excessive memory allocation and application crashes, disrupting services that rely on the Binutils package.
Versions prior to 2.24-5ubuntu14.2+esm6 for Ubuntu 14.04 LTS and prior to 2.26.1-1ubuntu1~16.04.8+esm1 for Ubuntu 16.04 LTS are affected.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for CVE-2017-14938 is 5.5, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
