CVE-2017-6307: High severity Tnef Project Tnef vulnerability

Q: What does an attacker need to do to exploit this issue?

The attacker needs to cause a user to process a crafted TNEF file. The CVSS vector indicates local attack access and required user interaction, with no privileges required.

Q: What is the potential impact if exploitation succeeds?

The out-of-bounds writes can lead to attacker-controlled invalid memory read and write operations. The reported impact includes high confidentiality, integrity, and availability impact.

Q: Which versions need remediation?

Tnef versions before 1.4.13 are affected. A patch is available; update to a fixed version supplied by the relevant vendor or distribution.

Published Feb 24, 2017

Updated

An issue was discovered in tnef before 1.4.13. Two OOB Writes have been identified in src/mapiattr.c:mapiattrread(). These might lead to invalid read and write operations, controlled by an attacker.

Affected Software

2 affected components

Tnef Project Tnef<=1.4.12

Debian Debian Linux=8.0

Remediation

Event History

Feb 24, 2017

CVE Published

via MITRE·04:23 AM

Data Sourced

via MITRE·04:23 AM

Description

Data Sourced

via NVD·04:59 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

The attacker needs to cause a user to process a crafted TNEF file. The CVSS vector indicates local attack access and required user interaction, with no privileges required.

What is the potential impact if exploitation succeeds?

The out-of-bounds writes can lead to attacker-controlled invalid memory read and write operations. The reported impact includes high confidentiality, integrity, and availability impact.

Which versions need remediation?

Tnef versions before 1.4.13 are affected. A patch is available; update to a fixed version supplied by the relevant vendor or distribution.

CVE-2017-6307: High severity Tnef Project Tnef vulnerability

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What is the potential impact if exploitation succeeds?

Which versions need remediation?