radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in IMAGE_DIRECTORY_ENTRY_SECURITY.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in     r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in     IMAGE_DIRECTORY_ENTRY_SECURITY. (CVE-2020-17487)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in
    parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section. (CVE-2020-16269)

  - radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in
    r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in
    IMAGE_DIRECTORY_ENTRY_SECURITY. (CVE-2020-17487)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-f3ebd7554c advisory.

  - radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in     parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section. (CVE-2020-16269)

  - radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in     r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in     IMAGE_DIRECTORY_ENTRY_SECURITY. (CVE-2020-17487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-e3c95619c1 advisory.

  - radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in     parse_typedef in type_dwarf.c via a malformed DW_AT_name in the .debug_info section. (CVE-2020-16269)

  - radare2 4.5.0 misparses signature information in PE files, causing a segmentation fault in     r_x509_parse_algorithmidentifier in libr/util/x509.c. This is due to a malformed object identifier in     IMAGE_DIRECTORY_ENTRY_SECURITY. (CVE-2020-17487)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250465	Linux Distros Unpatched Vulnerability : CVE-2020-17487	Nessus	Misc.	high
406878	Alpine: multiple radare2 packages: security update to 4.5.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406878	Alpine: multiple radare2 packages: security update to 4.5.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
148795	Fedora 33 : radare2 (2021-f3ebd7554c)	Nessus	Fedora Local Security Checks	high
146850	Fedora 32 : radare2 (2021-e3c95619c1)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-17487

high

Tenable Plugins

high

high

high

high

high