Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot



Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2018-18661
CVE-2018-12900
CVE-2017-9147
CVE-2017-9117
CVE-2016-9273
CVE-2016-3621
CVE-2016-3620
CVE-2016-3619
CVE-2015-8870
CWE-ID CWE-476
CWE-122
CWE-20
CWE-126
CWE-125
CWE-190
Exploitation vector Network
Public exploit Public exploit code for vulnerability #3 is available.
Vulnerable software
 Dynamic System Analysis (DSA) Preboot
Other software / Other software solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Null pointer dereference

EUVDB-ID: #VU15901

Risk: Low

CVSSv4.0: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-18661

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the function LZWDecode in the file tif_lzw.c. A remote attacker can trick the victim into opening a specially crafted input, trigger NULL pointer dereference and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU16180

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12900

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to heap-based buffer overflow in the cpSeparateBufToContigBuf function in tiffcp.c. A remote unauthenticated attacker can trick the victim into opening a specially crafted TIFF file that can trigger memory corruption and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper input validation

EUVDB-ID: #VU7403

Risk: Low

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-9147

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exits due to invalid read in the _TIFFVGetField function in tif_dir.c. A remote attacker can send specially crafted TIFF file and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Heap-based buffer over-read

EUVDB-ID: #VU11498

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-9117

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists in bmp2tiff due to heap-based buffer over-read when the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input. A remote attacker can trigger memory corruption and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds read

EUVDB-ID: #VU32102

Risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-9273

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local non-authenticated attacker to perform a denial of service (DoS) attack.

tiffsplit in libtiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted file, related to changing td_nstrips in TIFF_STRIPCHOP mode.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Out-of-bounds read

EUVDB-ID: #VU32168

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-3621

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The LZWEncode function in tif_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used,. A remote attacker can perform a denial of service (buffer over-read) via a crafted BMP image.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU103972

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-3620

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF, when the "-c zip" option is used. A remote attacker can perform a denial of service (buffer over-read) by sending a crafted BMP image.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU40087

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-3619

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in The DumpModeEncode function in tif_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used,. A remote attacker can perform a denial of service (buffer over-read) via a crafted BMP image.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Integer overflow

EUVDB-ID: #VU103977

Risk: High

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-8870

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory.

The vulnerability exists in tools/bmp2tiff.c in LibTIFF. A remote attacker can pass specially crafted width and length values in RLE4 or RLE8 data in a BMP file to the application, trigger integer overflow and cause a denial of service (heap-based buffer over-read), or possibly obtain sensitive information from process memory

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dynamic System Analysis (DSA) Preboot: before dsyte2z-9.65

CPE2.3 External links

https://www.ibm.com/support/pages/node/882120


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###