Buffer Overflow Vulnerability in GNU Binutils Package
Summary
UBUNTU-CVE-2017-9755: opcodes/i386-dis.c in GNU Binutils 2.28 does not consider the number of registers for bnd mode, which allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecif... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Binutils is a collection of binary tools that are essential for the development and management of software on Unix-like operating systems. It includes tools for assembling, linking, and manipulating binary files. The package is widely used in various development environments and is crucial for compiling and debugging applications. However, a vulnerability in the opcodes/i386-dis.c file can lead to severe security risks, including denial of service and potential exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2017-9755 in GNU Binutils version 2.28 arises from the mishandling of the number of registers in bnd mode within the i386-dis.c file. This flaw allows remote attackers to exploit crafted binary files, leading to a buffer overflow, application crashes, and potentially other unspecified impacts. The vulnerability can be triggered during the execution of commands like 'objdump -D', making it a significant risk for systems utilizing this version of Binutils.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the affected commands on untrusted binary files until the package is updated. This can help mitigate the risk of exploitation while waiting for a permanent fix.
Conclusion
The CVE-2017-9755 vulnerability in GNU Binutils poses a significant risk due to its potential to cause buffer overflows and application crashes. Users are strongly advised to update their Binutils package to the patched version to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for binutils →
FAQ
CVE-2017-9755 is a vulnerability in GNU Binutils that can lead to a buffer overflow and application crashes when processing crafted binary files.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2017-9755 is 7.8, indicating a high severity level.
If immediate updates are not possible, refrain from using the affected commands on untrusted binary files as a temporary measure.
More information about GNU Binutils can be found on its official website or through its documentation, which provides insights into its functionalities and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
