#VU32304 Stack-based buffer overflow in PCRE - CVE-2016-3191

Vulnerability identifier: #VU32304

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-3191

CWE-ID: CWE-121

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PCRE
Universal components / Libraries / Libraries used by multiple products

Vendor: PCRE

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the compile_branch function in pcre_compile.c in PCRE 8.x before 8.39 and pcre2_compile.c in PCRE2 before 10.22 mishandles patterns containing an (*ACCEPT) substring when processing a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-3542. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Update to version 8.39.

Vulnerable software versions

PCRE: 8.00 - 8.38

---

External links
https://rhn.redhat.com/errata/RHSA-2016-1025.html
https://vcs.pcre.org/pcre?view=revision&revision=1631
https://vcs.pcre.org/pcre2?view=revision&revision=489
https://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
https://www.securityfocus.com/bid/84810
https://www-01.ibm.com/support/docview.wss?uid=isg3T1023886
https://access.redhat.com/errata/RHSA-2016:1132
https://bto.bluecoat.com/security-advisory/sa128
https://bugs.debian.org/815920
https://bugs.debian.org/815921
https://bugs.exim.org/show_bug.cgi?id=1791
https://bugzilla.redhat.com/show_bug.cgi?id=1311503
https://www.tenable.com/security/tns-2016-18

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.