CVE-2019-16941: Critical severity ghidra vulnerability
NSA Ghidra through 9.0.4, when experimental mode is enabled, allows arbitrary code execution if the Read XML Files feature of Bit Patterns Explorer is used with a modified XML document. This occurs in Features/BytePatterns/src/main/java/ghidra/bitpatterns/info/FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call).
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-16941?
CVE-2019-16941 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2019-16941?
To mitigate CVE-2019-16941, users should disable the experimental mode and avoid using the Read XML Files feature with untrusted XML documents.
Which versions of Ghidra are affected by CVE-2019-16941?
CVE-2019-16941 affects NSA Ghidra versions up to and including 9.0.4.
What is the primary attack vector for CVE-2019-16941?
The primary attack vector for CVE-2019-16941 is through the use of a modified XML document in the Bit Patterns Explorer.
Can CVE-2019-16941 be exploited remotely?
Yes, CVE-2019-16941 can be exploited remotely if a user opens a malicious XML file in Ghidra's experimental mode.