An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.
References
| Link | Resource |
|---|---|
| http://www.ni.com/product-documentation/54099/en/ | Mitigation Vendor Advisory |
| http://www.securityfocus.com/bid/100519 | Third Party Advisory VDB Entry |
| https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html | Exploit Patch Third Party Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273 | Exploit Third Party Advisory VDB Entry |
| http://www.ni.com/product-documentation/54099/en/ | Mitigation Vendor Advisory |
| http://www.securityfocus.com/bid/100519 | Third Party Advisory VDB Entry |
| https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html | Exploit Patch Third Party Advisory |
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273 | Exploit Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 03:24
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 7.5 |
| References | () http://www.ni.com/product-documentation/54099/en/ - Mitigation, Vendor Advisory | |
| References | () http://www.securityfocus.com/bid/100519 - Third Party Advisory, VDB Entry | |
| References | () https://0patch.blogspot.com/2017/09/0patching-rsrc-arbitrary-null-write.html - Exploit, Patch, Third Party Advisory | |
| References | () https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0273 - Exploit, Third Party Advisory, VDB Entry |
19 Apr 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution. |
Information
Published : 2017-09-05 18:29
Updated : 2024-11-21 03:24
NVD link : CVE-2017-2779
Mitre link : CVE-2017-2779
CVE.ORG link : CVE-2017-2779
JSON object : View
Products Affected
ni
- labview
CWE
CWE-787
Out-of-bounds Write