CVE-2017-7938: Buffer Overflow
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1.2+deb12u1Fixed in 1.3a-6Fixed in 1.3a-8 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1.2ubuntu0.22.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-3ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running DMitry version 1.3a on Unix are affected. Exposure is especially relevant where DMitry runs automatically and processes hostnames or other arguments derived from untrusted local data, such as log files.
What does an attacker need to exploit it?
An attacker needs a way to cause DMitry to receive an overly long argument. The described automated-processing scenario means this may be possible indirectly if attacker-controlled hostname strings are later read from local logs and passed to DMitry.
What is the likely impact?
A long argument can crash the DMitry application, causing denial of service. The available information also notes the possibility of other unspecified impact.