CVE-2013-7386: Medium severity Rom Walton Boinc vulnerability
Format string flaw was found in the way boinc-client, a Berkeley Open Infrastructure for Network Computing (BOINC) client for distributed computing, performed account information write / dump into corresponding XML file. An attacker could provide an account file (file containing account information) with specially-crafted value of the 'guiurls' item that, when processed would lead to boinc-client executable crash or, potentially, arbitrary code execution with the privileges of the user running the boinc-client binary.
References: [1] http://www.openwall.com/lists/oss-security/2013/04/28/3
Relevant upstream patch: [2] http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git;a=commitdiff;h=99258dcecba8ef36e1ce0fd6e0dacffe53613ac9
Other sources
Format string vulnerability in the PROJECT::writeaccountfile function in client/csaccount.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the guiurls item in an account file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7386?
CVE-2013-7386 is considered to have a high severity due to its potential exploitation via format string attacks.
How do I fix CVE-2013-7386?
To fix CVE-2013-7386, update to the patched version of BOINC that is higher than 7.2.33.
What software does CVE-2013-7386 affect?
CVE-2013-7386 affects the BOINC client version 7.2.33.
What type of vulnerability is CVE-2013-7386?
CVE-2013-7386 is a format string vulnerability that can allow an attacker to manipulate how account information is processed.
Can CVE-2013-7386 be exploited remotely?
Yes, CVE-2013-7386 can potentially be exploited remotely if an attacker provides a malicious account file.