LibOFX CVE-2017-2816 Stack Based Buffer Overflow Vulnerability

Bugtraq ID:	100828
Class:	Boundary Condition Error
CVE:	CVE-2017-2816
Remote:	Yes
Local:	No
Published:	Sep 13 2017 12:00AM
Updated:	Sep 13 2017 12:00AM
Credit:	Cory Duplantis of Cisco Talos.
Vulnerable:	LibOFX LibOFX 0.9.11
Not Vulnerable:

LibOFX CVE-2017-2816 Stack Based Buffer Overflow Vulnerability

LibOFX is prone to a stack-based buffer overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely cause a denial-of-service condition.

LibOFX 0.9.11 is vulnerable; other versions may also be affected.

LibOFX CVE-2017-2816 Stack Based Buffer Overflow Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

LibOFX CVE-2017-2816 Stack Based Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LibOFX CVE-2017-2816 Stack Based Buffer Overflow Vulnerability

References:

• libofx Homepage (libofx)
  
• TALOS-2017-0317 LibOFX Tag Parsing Code Execution Vulnerability (talosintelligence.com)