CVE-2018-25427: Arm Whois 3.11 Buffer Overflow via SEH Overwrite
Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution when the application processes the input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Arm Whois 3.11from your environment.Uninstall or stop running Arm Whois 3.11 on any systems until an official vendor patch or fixed version is available.
- Configuration
Enforce a maximum length on IP address and domain input so inputs exceeding 658 bytes are rejected or truncated to prevent the stack-based buffer overflow (reject/limit user-supplied input to 658 bytes or less).
Arm Whois 3.11 max_input_length = <=658 bytes - Compensating control
Restrict network access to hosts running Arm Whois 3.11 using firewalls, ACLs, or network segmentation to prevent remote attackers from reaching the service.
- Operational
Monitor logs and incoming requests for inputs longer than 658 bytes and investigate or isolate any hosts that show such attempts; take suspected compromised systems offline and perform forensic analysis until remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25427?
CVE-2018-25427 has a severity rating of 9.3, indicating it's critical.
How do I fix CVE-2018-25427?
Fixing CVE-2018-25427 involves updating Arm Whois to a version that addresses the buffer overflow vulnerability.
What type of vulnerability is CVE-2018-25427?
CVE-2018-25427 is a stack-based buffer overflow vulnerability that can allow remote code execution.
What are the potential impacts of CVE-2018-25427?
Exploitation of CVE-2018-25427 can result in arbitrary code execution, leading to complete system compromise.
Who is affected by CVE-2018-25427?
Users of Arm Whois version 3.11 are particularly affected by CVE-2018-25427 due to the buffer overflow vulnerability.