The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.

It was discovered that GNU binutils contained a large number of security issues. If a user or automated system were tricked into processing a specially crafted file, a remote attacker could cause GNU binutils to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201908-01 (Binutils: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Binutils. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to compile/execute a specially       crafted ELF, object, PE, or binary file, could possibly cause a Denial of       Service condition or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has binutils packages installed that are affected by multiple vulnerabilities:

  - The Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (excessive memory     allocation and application crash) via a crafted ELF     file, as demonstrated by _bfd_elf_parse_attributes in     elf-attrs.c and bfd_malloc in libbfd.c. This can occur     during execution of nm. (CVE-2018-13033)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in     peXXigen.c in the Binary File Descriptor (BFD) library     (aka libbfd), as distributed in GNU Binutils 2.30,     processes a negative Data Directory size with an     unbounded loop that increases the value of     (external_IMAGE_DEBUG_DIRECTORY) *edd so that the     address exceeds its own memory region, resulting in an     out-of-bounds memory write, as demonstrated by objcopy     copying private info with
    _bfd_pex64_bfd_copy_private_bfd_data_common in     pex64igen.c. (CVE-2018-10534)

  - The ignore_section_sym function in elf.c in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the     output_section pointer in the case of a symtab entry     with a SECTION type that has a 0 value, which allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a crafted     file, as demonstrated by objcopy. (CVE-2018-10535)

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted binary file, as demonstrated by readelf.
    (CVE-2018-10372)

  - concat_filename in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed in     GNU Binutils 2.30, allows remote attackers to cause a     denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as     demonstrated by nm-new. (CVE-2018-10373)

  - The display_debug_ranges function in dwarf.c in GNU     Binutils 2.30 allows remote attackers to cause a denial     of service (integer overflow and application crash) or     possibly have unspecified other impact via a crafted ELF     file, as demonstrated by objdump. (CVE-2018-7643)

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information. (CVE-2018-7568, CVE-2018-7569)

  - The swap_std_reloc_in function in aoutx.h in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference and     application crash) via a crafted ELF file, as     demonstrated by objcopy. (CVE-2018-7642)

  - The bfd_section_from_shdr function in elf.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (segmentation     fault) via a large attribute section. (CVE-2018-8945)

  - In the coff_pointerize_aux function in coffgen.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, an index is not     validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF object.
    (CVE-2018-7208)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An integer wraparound has been discovered in the Binary File Descriptor (BFD) library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.(CVE-2018-7568)

The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a 'SECTION' type that has a '0' value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.(CVE-2018-10535)

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.(CVE-2018-7643)

concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.(CVE-2018-10373)

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.(CVE-2018-6323)

An integer wraparound has been discovered in the Binary File Descriptor (BFD) library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.(CVE-2018-7569)

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.(CVE-2018-13033)

process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.(CVE-2018-10372)

In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.(CVE-2018-7208)

Security Fix(es) :

  - binutils: Improper bounds check in     coffgen.c:coff_pointerize_aux() allows for denial of     service when parsing a crafted COFF file (CVE-2018-7208)

  - binutils: integer overflow via an ELF file with corrupt     dwarf1 debug information in libbfd library     (CVE-2018-7568)

  - binutils: integer underflow or overflow via an ELF file     with a corrupt DWARF FORM block in libbfd library     (CVE-2018-7569)

  - binutils: NULL pointer dereference in swap_std_reloc_in     function in aoutx.h resulting in crash (CVE-2018-7642)

  - binutils: Integer overflow in the display_debug_ranges     function resulting in crash (CVE-2018-7643)

  - binutils: Crash in elf.c:bfd_section_from_shdr() with     crafted executable (CVE-2018-8945)

  - binutils: Heap-base buffer over-read in     dwarf.c:process_cu_tu_index() allows for denial of     service via crafted file (CVE-2018-10372)

  - binutils: NULL pointer dereference in     dwarf2.c:concat_filename() allows for denial of service     via crafted file (CVE-2018-10373)

  - binutils: out of bounds memory write in peXXigen.c files     (CVE-2018-10534)

  - binutils: NULL pointer dereference in elf.c     (CVE-2018-10535)

  - binutils: Uncontrolled Resource Consumption in execution     of nm (CVE-2018-13033)

An update for binutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es) :

* binutils: Improper bounds check in coffgen.c:coff_pointerize_aux() allows for denial of service when parsing a crafted COFF file (CVE-2018-7208)

* binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library (CVE-2018-7568)

* binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library (CVE-2018-7569)

* binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash (CVE-2018-7642)

* binutils: Integer overflow in the display_debug_ranges function resulting in crash (CVE-2018-7643)

* binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable (CVE-2018-8945)

* binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file (CVE-2018-10372)

* binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted file (CVE-2018-10373)

* binutils: out of bounds memory write in peXXigen.c files (CVE-2018-10534)

* binutils: NULL pointer dereference in elf.c (CVE-2018-10535)

* binutils: Uncontrolled Resource Consumption in execution of nm (CVE-2018-13033)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

From Red Hat Security Advisory 2018:3032 :

An update for binutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es) :

* binutils: Improper bounds check in coffgen.c:coff_pointerize_aux() allows for denial of service when parsing a crafted COFF file (CVE-2018-7208)

* binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library (CVE-2018-7568)

* binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library (CVE-2018-7569)

* binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash (CVE-2018-7642)

* binutils: Integer overflow in the display_debug_ranges function resulting in crash (CVE-2018-7643)

* binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable (CVE-2018-8945)

* binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file (CVE-2018-10372)

* binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted file (CVE-2018-10373)

* binutils: out of bounds memory write in peXXigen.c files (CVE-2018-10534)

* binutils: NULL pointer dereference in elf.c (CVE-2018-10535)

* binutils: Uncontrolled Resource Consumption in execution of nm (CVE-2018-13033)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

ID	Name	Product	Family	Severity
151919	Ubuntu 16.04 ESM : GNU binutils vulnerabilities (USN-4336-2)	Nessus	Ubuntu Local Security Checks	critical
135966	Ubuntu 18.04 LTS : GNU binutils vulnerabilities (USN-4336-1)	Nessus	Ubuntu Local Security Checks	critical
127559	GLSA-201908-01 : Binutils: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127252	NewStart CGSL CORE 5.04 / MAIN 5.04 : binutils Multiple Vulnerabilities (NS-SA-2019-0060)	Nessus	NewStart CGSL Local Security Checks	high
121047	Amazon Linux 2 : binutils (ALAS-2019-1138)	Nessus	Amazon Linux Local Security Checks	high
119179	Scientific Linux Security Update : binutils on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118983	CentOS 7 : binutils (CESA-2018:3032)	Nessus	CentOS Local Security Checks	high
118762	Oracle Linux 7 : binutils (ELSA-2018-3032)	Nessus	Oracle Linux Local Security Checks	high
118514	RHEL 7 : binutils (RHSA-2018:3032)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-13033

medium

Tenable Plugins

critical

critical

critical

high

high

high

high

high

high