Vulnerability Spotlight: LibOFX Tag Parsing Code Execution Vulnerability

2017-09-1307:24:00

[email protected] (Vanja Svajcer)

feedproxy.google.com

0.002 Low

EPSS

Percentile

55.3%

JSON

This vulnerability was discovered by Cory Duplantis of Talos<br /><br /><i>Update 9/20/2017: A <a href=“https://github.com/libofx/libofx/commit/a70934eea95c76a7737b83773bffe8738935082d”>patch</a> is now available to fix this issue.</i><br /><h3>Overview</h3><br />LibOFX is an open source implementation of OFX (Open Financial Exchange) an open format used by financial institutions to share financial data with clients. As an implementation of a complex standard, this library is used by financial software such as GnuCash. Talos has discovered an exploitable buffer overflow in the implementation: a specially crafted OFX file can cause a write out of bounds resulting in code execution. This vulnerability is not currently patched and Talos has not received a response from the developers within the period specified by the <a href=“https://www.cisco.com/c/en/us/about/security-center/vendor-vulnerability-policy.html”>Vendor Vulnerability Reporting and Disclosure Policy</a>.<br /><br /><a></a><br /><br /><h3>TALOS-2017-0317 (CVE-2017-2816) - LibOFX Tag Parsing Code Execution Vulnerability</h3><br />Ironically, the vulnerability is located in the way that tags are parsed by the sanitize function. In the function, the tag’s names are stored locally on the stack, a too long tag name results in a stack overflow.<br /><br />More details can be found in the vulnerability reports:<a href=“http://www.talosintelligence.com/reports/TALOS-2017-0317”>TALOS-2017-0317</a><br /><br />Tested Version: LibOFX 0.9.11<br /><br /><h2>Discussion</h2><br />As an open source library, LibOFX may be used in various financial applications. This vulnerability presents many attractive features for attackers. User interaction is not necessarily required to trigger the vulnerability, and any systems presenting with this vulnerability are likely to contain valuable financial information which can be stolen to conduct identity theft, fraud, or easily sold on to other criminals.<br /><br />Organisations may not be aware of the presence of this library being used to parse OFX files in third party software, or in software that has been developed as part of an in-house system. Keeping track of open source libraries used within in-house projects, and quickly applying patches supplied by third party vendors is vital to ensure that vulnerabilities such as these, which are particularly enticing to attackers, are properly managed.<br /><br /><h2>Coverage</h2><div><br /></div>The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.<br /><br />Snort Rules: 42277-42278<br /><br /><div>
<a href=“http://feeds.feedburner.com/~ff/feedburner/Talos?a=vlOSJxYrSZw:Dq1uEVfSRtU:yIl2AUoC8zA”><img src=“http://feeds.feedburner.com/~ff/feedburner/Talos?d=yIl2AUoC8zA”></img></a>
</div><img src=“http://feeds.feedburner.com/~r/feedburner/Talos/~4/vlOSJxYrSZw” height=“1” width=“1” alt />