realloc_symlink in rock.c in GNU libcdio before 1.0.0 allows remote attackers to cause a denial of service (NULL Pointer Dereference) via a crafted iso file.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5558-1 advisory.

    Zhao Liang discovered that libcdio was not properly performing memory management operations when     processing ISO files, which could result in a heap buffer overflow or in a NULL pointer dereference. If a     user or automated system were tricked into opening a specially crafted file, an attacker could possibly     use this issue to cause a denial of service. (CVE-2017-18198, CVE-2017-18199)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libcdio fixes the following issues :

The following security vulnerability was addressed :

CVE-2017-18199: Fixed a NULL pointer dereference in realloc_symlink in rock.c, which allowed remote attackers to cause a denial of service via a crafted ISO file. (bsc#1082821)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libcdio packages installed that are affected by multiple vulnerabilities:

  - A heap corruption bug was found in the way libcdio     handled processing of ISO files. An attacker could     potentially use this flaw to crash applications using     libcdio by tricking them into processing crafted ISO     files, thus resulting in local DoS. (CVE-2017-18198)

  - A NULL pointer dereference flaw was found in the way     libcdio handled processing of ISO files. An attacker     could potentially use this flaw to crash applications     using libcdio by tricking them into processing crafted     ISO files. (CVE-2017-18199)

  - A double-free flaw was found in the way libcdio handled     processing of ISO files. An attacker could potentially     use this flaw to crash applications using libcdio by     tricking them into processing crafted ISO files.
    (CVE-2017-18201)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libcdio fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2017-18199: Fixed a NULL pointer dereference in     realloc_symlink in rock.c (bsc#1082821)

  - CVE-2017-18201: Fixed a double free vulnerability in     get_cdtext_generic() in _cdio_generic.c (bsc#1082877)

  - Fixed several memory leaks (bsc#1082821)

This update was imported from the SUSE:SLE-15:Update update project.

A heap corruption bug was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files, thus resulting in local DoS.(CVE-2017-18198)

A double-free flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18201)

A NULL pointer dereference flaw was found in the way libcdio handled processing of ISO files. An attacker could potentially use this flaw to crash applications using libcdio by tricking them into processing crafted ISO files.(CVE-2017-18199)

This update for libcdio fixes the following issues: The following security vulnerabilities were addressed :

  - CVE-2017-18199: Fixed a NULL pointer dereference in     realloc_symlink in rock.c (bsc#1082821)

  - CVE-2017-18201: Fixed a double free vulnerability in     get_cdtext_generic() in _cdio_generic.c (bsc#1082877)

  - Fixed several memory leaks (bsc#1082821)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libcdio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libcdio: Heap-based buffer over-read in     print_iso9660_recurse function in iso-info.c     (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in     rock.c (CVE-2017-18199)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libcdio package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libcdio: Heap-based buffer over-read in     print_iso9660_recurse function in iso-info.c     (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in     rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in     lib/driver/_cdio_generic.c (CVE-2017-18201)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libcdio: Heap-based buffer over-read in     print_iso9660_recurse function in iso-info.c     (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in     rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in     lib/driver/_cdio_generic.c (CVE-2017-18201)

An update for libcdio is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The libcdio library provides an interface for CD-ROM access. It can be used by applications that need OS-independent and device-independent access to CD-ROM devices.

Security Fix(es) :

* libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c (CVE-2017-18198)

* libcdio: NULL pointer dereference in realloc_symlink in rock.c (CVE-2017-18199)

* libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c (CVE-2017-18201)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3246 advisory.

    - fix CVE-2017-18198 and CVE-2017-18199
    - fix CVE-2017-18201

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3246 advisory.

  - libcdio: Heap-based buffer over-read in print_iso9660_recurse function in iso-info.c (CVE-2017-18198)

  - libcdio: NULL pointer dereference in realloc_symlink in rock.c (CVE-2017-18199)

  - libcdio: Double free in get_cdtext_generic() in lib/driver/_cdio_generic.c (CVE-2017-18201)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Added patch to fix: CVE-2017-18198 (#1549644) Added patch to fix:
CVE-2017-18199 (#1549701) Added patches to fix: CVE-2017-18201 (#1549707)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
164012	Ubuntu 16.04 ESM : libcdio vulnerabilities (USN-5558-1)	Nessus	Ubuntu Local Security Checks	high
143882	SUSE SLES12 Security Update : libcdio (SUSE-SU-2020:3023-1)	Nessus	SuSE Local Security Checks	medium
127220	NewStart CGSL CORE 5.04 / MAIN 5.04 : libcdio Multiple Vulnerabilities (NS-SA-2019-0043)	Nessus	NewStart CGSL Local Security Checks	critical
123262	openSUSE Security Update : libcdio (openSUSE-2019-599)	Nessus	SuSE Local Security Checks	critical
121364	Amazon Linux 2 : libcdio (ALAS-2019-1151)	Nessus	Amazon Linux Local Security Checks	critical
120073	SUSE SLED15 / SLES15 Security Update : libcdio (SUSE-SU-2018:2236-1)	Nessus	SuSE Local Security Checks	critical
119907	EulerOS 2.0 SP2 : libcdio (EulerOS-SA-2018-1418)	Nessus	Huawei Local Security Checks	high
119518	EulerOS 2.0 SP3 : libcdio (EulerOS-SA-2018-1390)	Nessus	Huawei Local Security Checks	critical
119189	Scientific Linux Security Update : libcdio on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	critical
119000	CentOS 7 : libcdio (CESA-2018:3246)	Nessus	CentOS Local Security Checks	critical
118780	Oracle Linux 7 : libcdio (ELSA-2018-3246)	Nessus	Oracle Linux Local Security Checks	critical
118537	RHEL 7 : libcdio (RHSA-2018:3246)	Nessus	Red Hat Local Security Checks	critical
111638	openSUSE Security Update : libcdio (openSUSE-2018-857)	Nessus	SuSE Local Security Checks	critical
108494	Fedora 26 : libcdio (2018-199e6065ee)	Nessus	Fedora Local Security Checks	critical
107162	Fedora 27 : libcdio (2018-30a8492364)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2017-18199

medium

Tenable Plugins

high

medium

critical

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical