CVE-2017-11497: Buffer Overflow
First published: Mon Oct 02 2017(Updated: )
Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames longer than 1024 characters.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Thales Sentinel LDK | =2.10 | |
| Thales Sentinel LDK | =3.0 | |
| Thales Sentinel LDK | =7.1 | |
| Thales Sentinel LDK | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/102739
- http://www.securityfocus.com/bid/102906
- https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
- https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-002-sentinel-ldk-rte-language-packs-containing-malformed-filenames-lead-to-remote-code-execution/
- https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01
- https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
- https://www.iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx
Frequently Asked Questions
What is the severity of CVE-2017-11497?
CVE-2017-11497 is classified as a high severity vulnerability due to its potential to allow remote code execution.
How do I fix CVE-2017-11497?
To remediate CVE-2017-11497, upgrade to a version of Gemalto Sentinel LDK that is not affected, such as those released after 7.50.
What versions are affected by CVE-2017-11497?
CVE-2017-11497 affects Gemalto ACC versions from HASP SRM 2.10 to Sentinel LDK 7.50.
Who is impacted by CVE-2017-11497?
Organizations using any affected version of Gemalto Sentinel LDK are vulnerable to CVE-2017-11497.
What type of vulnerability is CVE-2017-11497?
CVE-2017-11497 is a stack buffer overflow vulnerability that can be exploited through malicious language packs.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gemalto
- canonical/thales sentinel ldk
- version/thales sentinel ldk/2.10
- version/thales sentinel ldk/3.0
- version/thales sentinel ldk/7.1
- version/thales sentinel ldk/7.50