Multiple vulnerabilities in HDF5

1) Division by zero

EUVDB-ID: #VU63943

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17438

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the H5D__select_io() function of H5Dselect.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_h5d__select_io_h5dselect
https://bugzilla.redhat.com/show_bug.cgi?id=1634139

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU63941

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17437

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln5#memory-leak-in-h5o_dtype_decode_helper

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds write

EUVDB-ID: #VU63940

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17436

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error in the ReadCode() function in decompress.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file, trigger out-of-bounds write, and perform a denial of service attack.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability..

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#invalid-write-memory-access-in-decompressc
https://bugzilla.redhat.com/show_bug.cgi?id=1634129

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU63938

Risk: Medium

CVSSv4.0: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17435

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in the H5O_attr_decode() function in H5Oattr.c in the HDF HDF5 when converting an HDF file to GIF file. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln7#heap-overflow-in-h5o_attr_decode
https://bugzilla.redhat.com/show_bug.cgi?id=1634125

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Division by zero

EUVDB-ID: #VU63937

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17434

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the function apply_filters() of h5repack_filters.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln4#divided-by-zero---poc_apply_filters_h5repack_filters
https://bugzilla.redhat.com/show_bug.cgi?id=1634121

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Heap-based buffer overflow

EUVDB-ID: #VU63935

Risk: Medium

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17433

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a boundary error in ReadGifImageDesc() in gifread.c in the HDF HDF5 when converting a GIF file to an HDF file. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln8#heap-overflow-in-readgifimagedesc
https://bugzilla.redhat.com/show_bug.cgi?id=1634118

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) NULL pointer dereference

EUVDB-ID: #VU63934

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17432

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in H5O_sdspace_encode() in H5Osdspace.c in the HDF HDF5. A remote attacker can trick the victim into opening specially crafted HDF5 file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln6#null-pointer-dereference-in-h5o_sdspace_encode
https://bugzilla.redhat.com/show_bug.cgi?id=1634115

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Division by zero

EUVDB-ID: #VU63932

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17237

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/blob/master/HDF5/README.md#divided-by-zero---h5d__chunk_set_info_real_div_by_zero
https://bugzilla.redhat.com/show_bug.cgi?id=1633860

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Resource exhaustion

EUVDB-ID: #VU63931

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17234

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5. A remote attacker can trick the victim into opening a specially crafted HDF5 file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln3#memory-leak---h5o__chunk_deserialize_memory_leak
https://bugzilla.redhat.com/show_bug.cgi?id=1633856

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Division by zero

EUVDB-ID: #VU63930

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-17233

CWE-ID: CWE-369 - Divide By Zero

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service attack.

The vulnerability exists due to a division by zero error in the H5D__create_chunk_file_map_hyper() function of H5Dchunk.c in the HDF HDF5 . A remote attacker can trick the victim into opening specially crafted HDF file and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HDF5: 1.0.0 - 1.10.3

CPE2.3

External links

https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln2#divided-by-zero---h5d__create_chunk_file_map_hyper_div_zero
https://bugzilla.redhat.com/show_bug.cgi?id=1633853

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Medium
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2018-17438 CVE-2018-17437 CVE-2018-17436 CVE-2018-17435 CVE-2018-17434 CVE-2018-17433 CVE-2018-17432 CVE-2018-17237 CVE-2018-17234 CVE-2018-17233
CWE-ID	CWE-369 CWE-400 CWE-787 CWE-125 CWE-122 CWE-476
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	HDF5 Universal components / Libraries / Libraries used by multiple products
Vendor	HDF Group