Minicom CVE-2017-7467 Local Buffer Overflow Vulnerability

Bugtraq ID:	97966
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-7467
Remote:	No
Local:	Yes
Published:	Apr 18 2017 12:00AM
Updated:	Jun 07 2017 11:02AM
Credit:	Alexander Peslyak (Openwall)
Vulnerable:	Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 minicom minicom 2.7 minicom minicom 1.83.1 + Caldera OpenLinux 2.4 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Mandriva Linux Mandrake 7.0 + Redhat Linux 7.0 + Redhat Linux 6.2 + S.u.S.E. Linux 7.1 + S.u.S.E. Linux 7.0 + S.u.S.E. Linux 6.4 + SCO eDesktop 2.4 + SCO eServer 2.3.1 + Slackware Linux 7.1 + Slackware Linux 7.0 minicom minicom 1.83 .0 + Caldera OpenLinux 2.4 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Mandriva Linux Mandrake 7.0 + S.u.S.E. Linux 7.1 + S.u.S.E. Linux 7.0 + S.u.S.E. Linux 6.4 + S.u.S.E. Linux 6.2 + SCO eDesktop 2.4 + SCO eServer 2.3.1 + Slackware Linux 7.1 + Slackware Linux 7.0 minicom minicom 1.82.1 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 3.5.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 + Mandriva Linux Mandrake 7.1 + Mandriva Linux Mandrake 7.0 + S.u.S.E. Linux 7.1 + S.u.S.E. Linux 7.0 + S.u.S.E. Linux 6.4 + Slackware Linux 7.1 + Slackware Linux 7.0 Gentoo Linux
Not Vulnerable:	minicom minicom 2.7.1

Minicom CVE-2017-7467 Local Buffer Overflow Vulnerability

Minicom is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to crash minicom or execute arbitrary code in the context of the minicom process. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to Minicom 2.7.1 are vulnerable.

Minicom CVE-2017-7467 Local Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Minicom CVE-2017-7467 Local Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Minicom CVE-2017-7467 Local Buffer Overflow Vulnerability

References:

• minicom Homepage (minicom)
  
• Bug 1442099 - (CVE-2017-7467) CVE-2017-7467 minicom: Out of bounds write in vt1 (Redhat)