The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a denial of service (out-of-bounds read) via a crafted ELF object file.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The dwarf_read_cie_fde_prefix function in dwarf_frame2.c in libdwarf 20151114 allows attackers to cause a     denial of service (out-of-bounds read) via a crafted ELF object file. (CVE-2016-2091)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several vulnerabilities were discovered in dwarfutils, a tool and library for reading/consuming and writing/producing DWARF debugging information. The Common Vulnerabilities and Exposures project identifies the following issues :

CVE-2015-8538

A specially crafted ELF file can cause a segmentation fault.

CVE-2015-8750

A specially crafted ELF file can cause a NULL pointer dereference.

CVE-2016-2050

Out-of-bounds write

CVE-2016-2091

Out-of-bounds read

CVE-2016-5034

Out-of-bounds write

CVE-2016-5036

Out-of-bounds read

CVE-2016-5038

Out-of-bounds read

CVE-2016-5039

Out-of-bounds read

CVE-2016-5042

A specially crafted DWARF section can cause an infinite loop, reading from increasing memory addresses until the application crashes.

For Debian 7 'Wheezy', these problems have been fixed in version 20120410-2+deb7u2.

We recommend that you upgrade your dwarfutils packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 20160507 release - fixes many outstanding crash bugs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
219303	Linux Distros Unpatched Vulnerability : CVE-2016-2091	Nessus	Misc.	low
94143	Debian DLA-669-1 : dwarfutils security update	Nessus	Debian Local Security Checks	high
92205	Fedora 24 : libdwarf (2016-f36c5935e5)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-2091

low

Tenable Plugins

low

high

medium