CVE-2017-11498: Buffer Overflow
First published: Mon Oct 02 2017(Updated: )
Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack (ZIP file) with invalid HTML files.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Thales Sentinel LDK | =2.10 | |
| Thales Sentinel LDK | =3.0 | |
| Thales Sentinel LDK | =7.1 | |
| Thales Sentinel LDK | =7.50 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/102739
- http://www.securityfocus.com/bid/102906
- https://cert-portal.siemens.com/productcert/pdf/ssa-727467.pdf
- https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-001-sentinel-ldk-rte-language-pack-with-invalid-html-files-leads-to-denial-of-service/
- https://ics-cert.us-cert.gov/advisories/ICSA-18-018-01
- https://ics-cert.us-cert.gov/advisories/ICSA-18-093-01
- https://www.iotvillage.org/slides_dc25/Sergey_Vlad_DEFCON_IOT_Village_Public2017.pptx
Frequently Asked Questions
What is the severity of CVE-2017-11498?
CVE-2017-11498 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2017-11498?
To mitigate CVE-2017-11498, update to the latest version of Sentinel LDK that addresses the buffer overflow vulnerability.
What software versions are affected by CVE-2017-11498?
CVE-2017-11498 impacts all versions of Gemalto ACC from HASP SRM 2.10 to Sentinel LDK 7.50.
Can CVE-2017-11498 be exploited remotely?
Yes, CVE-2017-11498 can be exploited remotely using a malicious language pack containing invalid HTML files.
What are the implications of CVE-2017-11498?
Exploiting CVE-2017-11498 can lead to a denial of service, causing the affected remote process to shut down.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/author
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/gemalto
- canonical/thales sentinel ldk
- version/thales sentinel ldk/2.10
- version/thales sentinel ldk/3.0
- version/thales sentinel ldk/7.1
- version/thales sentinel ldk/7.50