UBUNTU-CVE-2017-7938: Buffer Overflow
Stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) version 1.3a (Unix) allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long argument. An example threat model is automated execution of DMitry with hostname strings found in local log files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1ubuntu0.20.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-1.2ubuntu0.22.04.1~esm1 - Upgrade
Upgrade
ubuntu/dmitryto a version that resolves this vulnerability.Fixed in 1.3a-3ubuntu0.1~esm1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that run DMitry 1.3a on Unix and process attacker-controlled or untrusted hostname strings are exposed. A cited example is automated DMitry execution using hostname values collected from local log files.
What does an attacker need to exploit it?
An attacker needs a way to supply a long argument to DMitry, such as by influencing a hostname string passed into an automated invocation. The vector is local and requires low privileges; no user interaction is required.
What can happen if exploitation succeeds?
The documented impact includes an application crash, resulting in denial of service. Other impact is possible but unspecified.