An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI     3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary     code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.
    (CVE-2017-2808)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202004-05 (ledger: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ledger. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       file using ledger, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for ledger fixes the following issues :

ledger was updated to 3.1.3 :

  + Properly reject postings with a comment right after the     flag (bug #1753)

  + Make sorting order of lot information deterministic (bug     #1747)

  + Fix bug in tag value parsing (bug #1702)

  + Remove the org command, which was always a hack to begin     with (bug #1706)

  + Provide Docker information in README

  + Various small documentation improvements 

This also includes the update to 3.1.2 :

  + Increase maximum length for regex from 255 to 4095 (bug     #981)

  + Initialize periods from from/since clause rather than     earliest transaction date (bug #1159)

  + Check balance assertions against the amount after the     posting (bug #1147)

  + Allow balance assertions with multiple posts to same     account (bug #1187)

  + Fix period duration of 'every X days' and similar     statements (bug #370)

  + Make option --force-color not require --color anymore     (bug #1109)

  + Add quoted_rfc4180 to allow CVS output with RFC 4180     compliant quoting.

  + Add support for --prepend-format in accounts command

  + Fix handling of edge cases in trim function (bug #520)

  + Fix auto xact posts not getting applied to account total     during journal parse (bug #552)

  + Transfer null_post flags to generated postings

  + Fix segfault when using --market with --group-by

  + Use amount_width variable for budget report

  + Keep pending items in budgets until the last day they     apply

  + Fix bug where .total used in value expressions breaks     totals

  + Make automated transactions work with assertions (bug     #1127)

  + Improve parsing of date tokens (bug #1626)

  + Don't attempt to invert a value if it's already zero     (bug #1703)

  + Do not parse user-specified init-file twice

  + Fix parsing issue of effective dates (bug #1722,     TALOS-2017-0303, CVE-2017-2807)

  + Fix use-after-free issue with deferred postings (bug     #1723, TALOS-2017-0304, CVE-2017-2808)

  + Fix possible stack overflow in option parsing routine     (bug #1222, CVE-2017-12481)

  + Fix possible stack overflow in date parsing routine (bug     #1224, CVE-2017-12482)

  + Fix use-after-free when using --gain (bug #541)

  + Python: Removed double quotes from Unicode values.

  + Python: Ensure that parse errors produce useful     RuntimeErrors

  + Python: Expose journal expand_aliases

  + Python: Expose journal_t::register_account

  + Improve bash completion

  + Emacs Lisp files have been moved to     https://github.com/ledger/ledger-mode

  + Various documentation improvements

Talos reports :

An exploitable buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution. An attacker can construct a malicious journal file to trigger this vulnerability.

An exploitable use-after-free vulnerability exists in the account parsing component of the Ledger-CLI 3.1.1. A specially crafted ledger file can cause a use-after-free vulnerability resulting in arbitrary code execution. An attacker can convince a user to load a journal file to trigger this vulnerability.

ID	Name	Product	Family	Severity
253718	Linux Distros Unpatched Vulnerability : CVE-2017-2808	Nessus	Misc.	high
135116	GLSA-202004-05 : ledger: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
126909	openSUSE Security Update : ledger (openSUSE-2019-1779)	Nessus	SuSE Local Security Checks	high
103482	FreeBSD : ledger -- multiple vulnerabilities (d843a984-7f22-484f-ba81-483ddbe30dc3)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-2808

high

Tenable Plugins

high

high

high

high