Denial of Service Vulnerability in Binutils: CVE-2018-10373
Summary
UBUNTU-CVE-2018-10373: concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application cr... Affects binutils versions 2.23.52.20130913-0ubuntu1 – 2.24-5ubuntu3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Binutils is a collection of binary tools used for handling binary files, including object files, archives, and executable files. It provides essential functionalities such as linking, assembling, and disassembling, making it a critical component for developers working with compiled languages. The vulnerability CVE-2018-10373 affects multiple versions of Binutils, allowing attackers to exploit the software through crafted binary files.
Vulnerability Detail
The vulnerability, identified as CVE-2018-10373, originates from a flaw in the 'concat_filename' function within the dwarf2.c file of the Binary File Descriptor (BFD) library, which is part of GNU Binutils 2.30. This flaw allows remote attackers to cause a denial of service by triggering a NULL pointer dereference, leading to application crashes. The potential ramifications include service interruptions and the inability to process binary files correctly, which can disrupt development workflows.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid processing untrusted or unknown binary files until the package is updated. This can be done by implementing strict file validation checks in the application that utilizes Binutils.
Conclusion
CVE-2018-10373 is a significant vulnerability in the Binutils package that can lead to denial of service attacks. Users are encouraged to update their packages to the latest versions to protect their systems from potential exploitation. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for binutils →
FAQ
CVE-2018-10373 is a vulnerability in the Binutils package that allows remote attackers to cause a denial of service through a crafted binary file.
The vulnerability can lead to application crashes when processing malicious binary files, potentially disrupting development and deployment processes.
Yes, users can update to the patched version of Binutils to mitigate the vulnerability. The recommended version is 2.30-21ubuntu1~18.04.3 or later.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for binutils.
