Rejected reason: Non Security Issue. See the binutils security policy for more details, https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt

An update of the crash package has been released.

Hao Wang reports :

There's a flaw in the BFD library of binutils in versions before 2.36.
An attacker who supplies a crafted file to an application linked with BFD, and using the DWARF functionality, could cause an impact to system availability by way of excessive memory consumption.

According to the version of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - There's a flaw in the BFD library of binutils. An     attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality,     could cause an impact to system availability by way of     excessive memory consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A flaw was found in bfd_pef_parse_function_stubs of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35507)

  - A flaw was found in bfd_pef_scan_start_address() of     bfd/pef.c in binutils which could allow an attacker who     is able to submit a crafted file to be processed by     objdump to cause a NULL pointer dereference. The     greatest threat of this flaw is to application     availability.(CVE-2020-35496)

  - A flaw was found in binutils. An attacker who is able     to submit a crafted input file to be processed by the     objdump program could cause a null pointer dereference.
    The greatest threat from this flaw is to application     availability.(CVE-2020-35495)

  - There's a flaw in the BFD library of binutils. An     attacker who supplies a crafted file to an application     linked with BFD, and using the DWARF functionality,     could cause an impact to system availability by way of     excessive memory consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - Not found.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the binutils package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - There is an open race window when writing output in the     following utilities in GNU binutils version 2.35 and     earlier:ar, objcopy, strip, ranlib. When these     utilities are run as a privileged user (presumably as     part of a script updating binaries across different     users), an unprivileged user can trick these utilities     into getting ownership of arbitrary files through a     symlink.(CVE-2021-20197)

  - There's a flaw in the BFD library of binutils in     versions before 2.36. An attacker who supplies a     crafted file to an application linked with BFD, and     using the DWARF functionality, could cause an impact to     system availability by way of excessive memory     consumption.(CVE-2021-3487)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the binutils package has been released.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
152668	FreeBSD : binutils -- excessive debug section size can cause excessive memory consumption in bfd's dwarf2.c read_section() (f4c54b81-bcc8-11eb-a7a6-080027f515ea)	Nessus	FreeBSD Local Security Checks	medium
151768	EulerOS 2.0 SP5 : binutils (EulerOS-SA-2021-2212)	Nessus	Huawei Local Security Checks	medium
151306	EulerOS Virtualization for ARM 64 3.0.2.0 : binutils (EulerOS-SA-2021-2122)	Nessus	Huawei Local Security Checks	medium
151259	EulerOS Virtualization 3.0.6.6 : binutils (EulerOS-SA-2021-2045)	Nessus	Huawei Local Security Checks	medium
151241	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2058)	Nessus	Huawei Local Security Checks	medium
151220	EulerOS 2.0 SP9 : binutils (EulerOS-SA-2021-2047)	Nessus	Huawei Local Security Checks	medium
151158	EulerOS Virtualization for ARM 64 3.0.6.0 : binutils (EulerOS-SA-2021-2024)	Nessus	Huawei Local Security Checks	medium
151031	EulerOS 2.0 SP8 : binutils (EulerOS-SA-2021-1976)	Nessus	Huawei Local Security Checks	medium
150278	EulerOS Virtualization 2.9.1 : binutils (EulerOS-SA-2021-1964)	Nessus	Huawei Local Security Checks	medium
150249	EulerOS Virtualization 2.9.0 : binutils (EulerOS-SA-2021-1974)	Nessus	Huawei Local Security Checks	medium
149287	Photon OS 4.0: Binutils PHSA-2021-4.0-0017	Nessus	PhotonOS Local Security Checks	medium

Detections

Analytics

CVE-2021-3487

No Score

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium