National Instruments LabVIEW CVE-2017-2779 Memory Corruption Vulnerability

Bugtraq ID:	100519
Class:	Boundary Condition Error
CVE:	CVE-2017-2779
Remote:	Yes
Local:	No
Published:	Aug 29 2017 12:00AM
Updated:	Aug 29 2017 12:00AM
Credit:	Cory Duplantis of Cisco Talos.
Vulnerable:	National Instruments LabVIEW 2016 16.0
Not Vulnerable:

National Instruments LabVIEW CVE-2017-2779 Memory Corruption Vulnerability

National Instruments LabVIEW is prone to a memory-corruption vulnerability.

An attacker can exploit this issue to cause a denial-of-service condition. Note that this issue could be exploited to execute arbitrary code; however, this has not been confirmed.

National Instruments LabVIEW 2016 version 16.0 is vulnerable; other versions may also be affected.

National Instruments LabVIEW CVE-2017-2779 Memory Corruption Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

National Instruments LabVIEW CVE-2017-2779 Memory Corruption Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

National Instruments LabVIEW CVE-2017-2779 Memory Corruption Vulnerability

References:

• National Instruments LabVIEW Homepage (National Instruments LabVIEW)
  
• TALOS-2017-0273 National Instruments LabVIEW RSRC Arbitrary Null Write Code Exec (TALOS)