Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libplist: Out-of-bounds heap buffer read in plistutil (CVE-2017-5545)

  - The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-     of-bounds heap read and crash) via a crafted file. (CVE-2017-5834)

  - libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors     involving an offset size of zero. (CVE-2017-5835)

  - The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash)     via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
    (CVE-2017-5836)

  - The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory corruption) via a crafted plist file. (CVE-2017-6435)

  - The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory allocation error) via a crafted plist file. (CVE-2017-6436)

  - The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (out-of-bounds read) via a crafted plist file. (CVE-2017-6437)

  - Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist     1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via     a crafted plist file. (CVE-2017-6438)

  - Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12     allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
    (CVE-2017-6439)

  - The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory allocation error) via a crafted plist file. (CVE-2017-6440)

  - Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19     allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)     via a crafted plist file. (CVE-2017-7982)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libplist: Out-of-bounds heap buffer read in plistutil (CVE-2017-5545)

  - The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-     of-bounds heap read and crash) via a crafted file. (CVE-2017-5834)

  - libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors     involving an offset size of zero. (CVE-2017-5835)

  - The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash)     via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
    (CVE-2017-5836)

  - The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory corruption) via a crafted plist file. (CVE-2017-6435)

  - The parse_string_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory allocation error) via a crafted plist file. (CVE-2017-6436)

  - The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (out-of-bounds read) via a crafted plist file. (CVE-2017-6437)

  - Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist     1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via     a crafted plist file. (CVE-2017-6438)

  - Heap-based buffer overflow in the parse_string_node function in bplist.c in libimobiledevice libplist 1.12     allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.
    (CVE-2017-6439)

  - The parse_data_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a     denial of service (memory allocation error) via a crafted plist file. (CVE-2017-6440)

  - Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19     allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash)     via a crafted plist file. (CVE-2017-7982)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

libplist is a library for reading and writing the Apple binary and XML property lists format. It's part of the libimobiledevice stack, providing access to iDevices (iPod, iPhone, iPad ...).

CVE-2017-5209

The base64decode function in base64.c allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.

CVE-2017-5545

The main function in plistutil.c allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.

CVE-2017-5834

The parse_dict_node function in bplist.c allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.

CVE-2017-5835

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

CVE-2017-6435

The parse_string_node function in bplist.c allows local users to cause a denial of service (memory corruption) via a crafted plist file.

CVE-2017-6436

The parse_string_node function in bplist.c allows local users to cause a denial of service (memory allocation error) via a crafted plist file.

CVE-2017-6439

Heap-based buffer overflow in the parse_string_node function in bplist.c allows local users to cause a denial of service (out-of-bounds write) via a crafted plist file.

CVE-2017-7982

Integer overflow in the plist_from_bin function in bplist.c allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.

For Debian 8 'Jessie', these problems have been fixed in version 1.11-3+deb8u1.

We recommend that you upgrade your libplist packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Wang Junjie discovered that Libplist incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a crash or denial or service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libplist fixes the following issues :

  - CVE-2017-5209: The base64decode function in libplist     allowed attackers to obtain sensitive information from     process memory or cause a denial of service (buffer     over-read) via split encoded Apple Property List data     (bsc#1019531).

  - CVE-2017-5545: The main function in plistutil.c in     libimobiledevice libplist allowed attackers to obtain     sensitive information from process memory or cause a     denial of service (buffer over-read) via Apple Property     List data that is too short. (bsc#1021610).

  - CVE-2017-5836: A type inconsistency in bplist.c was     fixed. (bsc#1023807)

  - CVE-2017-5835: A memory allocation error leading to DoS     was fixed. (bsc#1023822)

  - CVE-2017-5834: A heap-buffer overflow in parse_dict_node     was fixed. (bsc#1023848)

  - CVE-2017-6440: Ensure that sanity checks work on 32-bit     platforms. (bsc#1029631)

  - CVE-2017-7982: Add some safety checks, backported from     upstream (bsc#1035312). 

  - CVE-2017-5836: A maliciously crafted file could cause     the application to crash. (bsc#1023807).

  - CVE-2017-5835: Malicious crafted file could cause     libplist to allocate large amounts of memory and consume     lots of CPU (bsc#1023822) 

  - CVE-2017-5834: Maliciou crafted file could cause a heap     buffer overflow or segmentation fault (bsc#1023848) This     update was imported from the SUSE:SLE-12-SP2:Update     update project.

This update for libplist fixes the following issues :

  - CVE-2017-5209: The base64decode function in libplist     allowed attackers to obtain sensitive information from     process memory or cause a denial of service (buffer     over-read) via split encoded Apple Property List data     (bsc#1019531).

  - CVE-2017-5545: The main function in plistutil.c in     libimobiledevice libplist allowed attackers to obtain     sensitive information from process memory or cause a     denial of service (buffer over-read) via Apple Property     List data that is too short. (bsc#1021610).

  - CVE-2017-5836: A type inconsistency in bplist.c was     fixed. (bsc#1023807)

  - CVE-2017-5835: A memory allocation error leading to DoS     was fixed. (bsc#1023822)

  - CVE-2017-5834: A heap-buffer overflow in parse_dict_node     was fixed. (bsc#1023848)

  - CVE-2017-6440: Ensure that sanity checks work on 32-bit     platforms. (bsc#1029631)

  - CVE-2017-7982: Add some safety checks, backported from     upstream (bsc#1035312).

  - CVE-2017-5836: A maliciously crafted file could cause     the application to crash. (bsc#1023807).

  - CVE-2017-5835: Malicious crafted file could cause     libplist to allocate large amounts of memory and consume     lots of CPU (bsc#1023822)

  - CVE-2017-5834: Maliciou crafted file could cause a heap     buffer overflow or segmentation fault (bsc#1023848)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libplist fixes the following security issues :

  - CVE-2017-5545: The main function in plistutil.c in     libimobiledevice libplist allowed attackers to obtain     sensitive information from process memory or cause a     denial of service (buffer over-read) via Apple Property     List data that is too short. (bsc#1021610).

  - CVE-2017-5209: The base64decode function in base64.c in     libimobiledevice libplist through 1.12 allows attackers     to obtain sensitive information from process memory or     cause a denial of service (buffer over-read) via split     encoded Apple Property List data. (bsc#1019531)

  - CVE-2017-5836: A type inconsistency in bplist.c was     fixed. (bsc#1023807)

  - CVE-2017-5835: A memory allocation error leading to DoS     was fixed. (bsc#1023822)

  - CVE-2017-5834: A heap-buffer overflow in parse_dict_node     was fixed (bsc#1023848)

  - CVE-2017-7982: Denial of service (heap-based buffer     over-read and application crash) via a crafted plist     file (bsc#1035312)

  - CVE-2017-6440: A specially crafted plist file could lead     to denial of service (bsc#1029631)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196850	RHEL 7 : libplist (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196837	RHEL 6 : libplist (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
135190	Debian DLA-2168-1 : libplist security update	Nessus	Debian Local Security Checks	critical
103466	Ubuntu 14.04 LTS / 16.04 LTS : Libplist vulnerability (USN-3429-1)	Nessus	Ubuntu Local Security Checks	medium
100502	openSUSE Security Update : libplist (openSUSE-2017-627)	Nessus	SuSE Local Security Checks	critical
100374	SUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1379-1)	Nessus	SuSE Local Security Checks	critical
100354	SUSE SLED12 / SLES12 Security Update : libplist (SUSE-SU-2017:1368-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2017-7982

medium

Tenable Plugins

critical

critical

critical

medium

critical

critical

critical