Re: Buffer Overflow in graphviz via via a crafted config6a file

2024-1-28 06:3:52 Author: seclists.org(查看原文) 阅读量:14 收藏

On 1/20/24 15:07, Meng Ruijie wrote:

[Vulnerability description]
Buffer Overflow vulnerability in graphviz v.2.43.0 allows a remote attacker to execute arbitrary code via a crafted 
config6a file.

[Vulnerability Type]
Buffer Overflow

More specifically, this issue is an out-of-bounds read.

[Vendor of Product]
graphviz

[Affected Product Code Base]
graphviz - 2.43.0

AFAICT the issue was actually introduced in Graphviz 2.36. It was fixed 

in commit a95f977f5d809915ec4b14836d2b5b7f5e74881e (essentially 

reverting cf95714837f06f684929b54659523c2c9b1fc19f that introduced the 

issue), but there has been no release yet since then. The next release 

will be 10.0.0. So affected versions would be [2.36, 10.0.0).

To exploit this issue, you need to modify a typically-root-owned file. I 

am not suggesting it is hard to exploit, but see my remarks below.

[CVE Reference]
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46045 to this 
vulnerability.

Why was this issue gifted a CVE? If you want an out-of-bounds access in 

Graphviz, there is much lower hanging fruit.

As Alan Coopersmith has noted in a separate thread,¹ this stream of 

issues seems to have been bulk-created without much analysis. The CVE 

details still appear to be RESERVED in NVD. The Graphviz maintainers do 

not intend to contest this CVE, but I expect the details to be 

inaccurate when released as I’ve noted above.

¹ https://seclists.org/oss-sec/2024/q1/59
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Full Disclosure mailing list archives

Current thread: