Genivia gSOAP CVE-2017-9765 Stack Based Buffer Overflow Vulnerability

Bugtraq ID:	99868
Class:	Boundary Condition Error
CVE:	CVE-2017-9765
Remote:	Yes
Local:	No
Published:	Jul 18 2017 12:00AM
Updated:	Jul 18 2017 12:00AM
Credit:	Senrio
Vulnerable:	Genivia gSOAP 2.8.47 Genivia gSOAP 2.8 Genivia gSOAP 2.7.17 Genivia gSOAP 2.7 Genivia gSOAP 2.6.2 Genivia gSOAP 2.6 Genivia gSOAP 2.5.2 Genivia gSOAP 2.5 Genivia gSOAP 2.4 Genivia gSOAP 2.3 Genivia gSOAP 2.2 Genivia gSOAP 2.1 Genivia gSOAP 2.0 Genivia gSOAP 1.2 Genivia gSOAP 1.1
Not Vulnerable:	Genivia gSOAP 2.8.48 upd

Genivia gSOAP CVE-2017-9765 Stack Based Buffer Overflow Vulnerability

Genivia gSOAP is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

A remote attacker may exploit this issue to execute arbitrary code in the context of the affected device. Failed attempts will likely cause a denial-of-service condition.

Versions prior to gSOAP 2.8.48 upd are vulnerable.

Genivia gSOAP CVE-2017-9765 Stack Based Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Genivia gSOAP CVE-2017-9765 Stack Based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Genivia gSOAP CVE-2017-9765 Stack Based Buffer Overflow Vulnerability

References:

• gSOAP Changelog (Genivia)
  
• ACV-116267 Soap overflow (CVE-2017-9765) (Axis Communications)
  
• Devil's Ivy: Flaw in Widely Used Third-party Code Impacts Millions (Senrio)