CVE-2017-2779: High severity national instruments labview vulnerability
An exploitable memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2017, LabVIEW 2016, LabVIEW 2015, and LabVIEW 2014. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write. An attacker controlled VI file can be used to trigger this vulnerability and can potentially result in code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2779?
CVE-2017-2779 is classified as a high severity memory corruption vulnerability.
How do I fix CVE-2017-2779?
To fix CVE-2017-2779, update your LabVIEW installation to a version that is no longer vulnerable.
What versions of LabVIEW are affected by CVE-2017-2779?
LabVIEW versions 2014, 2015, 2016, and 2017 are affected by CVE-2017-2779.
What type of attack does CVE-2017-2779 facilitate?
CVE-2017-2779 facilitates an arbitrary null write through crafted Virtual Instrument (VI) files.
Can CVE-2017-2779 be exploited remotely?
Yes, CVE-2017-2779 can be exploited by an attacker remotely through specially crafted files.