radare2 denial of service vulnerability (CNVD-2017-32216)

radare2 is a set of libraries and tools for working with binary files. A security vulnerability exists in the 'storeversioninfognuverdef' function in the libr/bin/format/elf/elf.c file in radare2 version 2.0.0. A remote attacker can exploit this vulnerability to cause a denial of service invalid...

Code injection

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

UBUNTU-CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15385

The CVE-2017-15385 entry concerns radare2 2.0.0. The store_versioninfo_gnu_verdef function in libr/bin/format/elf/elf.c can be triggered by a crafted ELF file to cause a denial of service via an invalid r_read_le16 write, leading to an application crash. The available connected documents confirm ...

CVE-2017-15385

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15368

CVE-2017-15368 affects radare2 2.0.0: the wasm_dis function (libr/asm/arch/wasm/wasm.c) is exploitable via a crafted WASM file and can cause a stack-based buffer over-read, leading to a denial of service (application crash) and potentially other impact due to an incorrect r_hex_bin2str call. Reme...

CVE-2017-15368

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

PT-2017-14041

Name of the Vulnerable Software and Affected Versions radare2 version 2.0.0 Description The issue allows remote attackers to cause a denial of service, resulting in an application crash, or possibly have other unspecified impacts through a crafted ELF file. This is due to an invalid write in the ...

PT-2017-14026

Name of the Vulnerable Software and Affected Versions radare2 version 2.0.0 Description The issue allows remote attackers to cause a denial of service, resulting in a stack-based buffer over-read and application crash, or possibly have other unspecified impacts. This is achieved through a crafted...

CVE-2017-15368: Out-of-bounds Read

The wasmdis function in libr/asm/arch/wasm/wasm.c in radare2 2.0.0 allows remote attackers to cause a denial of service stack-based buffer over-read and application crash or possibly have unspecified other impact via a crafted WASM file that triggers an incorrect rhexbin2str call...

CVE-2017-15385: Improper Restriction of Operations within the Bounds of a Memory Buffer

The storeversioninfognuverdef function in libr/bin/format/elf/elf.c in radare2 2.0.0 allows remote attackers to cause a denial of service rreadle16 invalid write and application crash or possibly have unspecified other impact via a crafted ELF file...

Disassembler and Runtime Analysis

This post was authored by Paul Rascagneres.IntroductionIn the CCleaner 64bit stage 2 previously described in our blog, we explained that the attacker modified a legitimate executable that is part of "Symantec Endpoint". This file is named EFACli64.dll. The modification is performed in the runtime...