The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.

An update of the crash package has been released.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: NULL pointer dereference in bfd_elf_final_link function (CVE-2017-7614)

  - The srec_scan function in bfd/srec.c in libdbfd in GNU binutils before 2.25 allows remote attackers to     cause a denial of service (out-of-bounds read) via a small S-record. (CVE-2014-8484)

  - The setup_group function in bfd/elf.c in libbfd in GNU binutils 2.24 and earlier allows remote attackers     to cause a denial of service (crash) and possibly execute arbitrary code via crafted section group headers     in an ELF file. (CVE-2014-8485)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - binutils: Integer overflow in cplus-dem.c:get_count() allows for denial of service (CVE-2018-18483)

  - The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab     entry with a SECTION type that has a 0 value, which allows remote attackers to cause a denial of     service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.
    (CVE-2018-10535)

  - An issue was discovered in arm_pt in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30.
    Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive     stack frames: demangle_arm_hp_template, demangle_class_name, demangle_fund_type, do_type, do_arg,     demangle_args, and demangle_nested_args. This can occur during execution of nm-new. (CVE-2018-12641)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4336-2 advisory.

    USN-4336-1 fixed several vulnerabilities in GNU binutils. This update provides the corresponding update     for Ubuntu 16.04 ESM.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4336-1 advisory.

    It was discovered that GNU binutils contained a large number of security issues. If a user or automated     system were tricked into processing a specially-crafted file, a remote attacker could cause GNU binutils     to crash, resulting in a denial of service, or possibly execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201908-01 (Binutils: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Binutils. Please review       the referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to compile/execute a specially       crafted ELF, object, PE, or binary file, could possibly cause a Denial of       Service condition or have other unspecified impacts.
  Workaround :

    There is no known workaround at this time.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has binutils packages installed that are affected by multiple vulnerabilities:

  - The Binary File Descriptor (BFD) library (aka libbfd),     as distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (excessive memory     allocation and application crash) via a crafted ELF     file, as demonstrated by _bfd_elf_parse_attributes in     elf-attrs.c and bfd_malloc in libbfd.c. This can occur     during execution of nm. (CVE-2018-13033)

  - The _bfd_XX_bfd_copy_private_bfd_data_common function in     peXXigen.c in the Binary File Descriptor (BFD) library     (aka libbfd), as distributed in GNU Binutils 2.30,     processes a negative Data Directory size with an     unbounded loop that increases the value of     (external_IMAGE_DEBUG_DIRECTORY) *edd so that the     address exceeds its own memory region, resulting in an     out-of-bounds memory write, as demonstrated by objcopy     copying private info with
    _bfd_pex64_bfd_copy_private_bfd_data_common in     pex64igen.c. (CVE-2018-10534)

  - The ignore_section_sym function in elf.c in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, does not validate the     output_section pointer in the case of a symtab entry     with a SECTION type that has a 0 value, which allows     remote attackers to cause a denial of service (NULL     pointer dereference and application crash) via a crafted     file, as demonstrated by objcopy. (CVE-2018-10535)

  - process_cu_tu_index in dwarf.c in GNU Binutils 2.30     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted binary file, as demonstrated by readelf.
    (CVE-2018-10372)

  - concat_filename in dwarf2.c in the Binary File     Descriptor (BFD) library (aka libbfd), as distributed in     GNU Binutils 2.30, allows remote attackers to cause a     denial of service (NULL pointer dereference and     application crash) via a crafted binary file, as     demonstrated by nm-new. (CVE-2018-10373)

  - The display_debug_ranges function in dwarf.c in GNU     Binutils 2.30 allows remote attackers to cause a denial     of service (integer overflow and application crash) or     possibly have unspecified other impact via a crafted ELF     file, as demonstrated by objdump. (CVE-2018-7643)

  - An integer wraparound has been discovered in the Binary     File Descriptor (BFD) library distributed in GNU     Binutils up to version 2.30. An attacker could cause a     crash by providing an ELF file with corrupted DWARF     debug information. (CVE-2018-7568, CVE-2018-7569)

  - The swap_std_reloc_in function in aoutx.h in the Binary     File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service     (aout_32_swap_std_reloc_out NULL pointer dereference and     application crash) via a crafted ELF file, as     demonstrated by objcopy. (CVE-2018-7642)

  - The bfd_section_from_shdr function in elf.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, allows remote     attackers to cause a denial of service (segmentation     fault) via a large attribute section. (CVE-2018-8945)

  - In the coff_pointerize_aux function in coffgen.c in the     Binary File Descriptor (BFD) library (aka libbfd), as     distributed in GNU Binutils 2.30, an index is not     validated, which allows remote attackers to cause a     denial of service (segmentation fault) or possibly have     unspecified other impact via a crafted file, as     demonstrated by objcopy of a COFF object.
    (CVE-2018-7208)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An integer wraparound has been discovered in the Binary File Descriptor (BFD) library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.(CVE-2018-7568)

The ignore_section_sym function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, does not validate the output_section pointer in the case of a symtab entry with a 'SECTION' type that has a '0' value, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file, as demonstrated by objcopy.(CVE-2018-10535)

The display_debug_ranges function in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact via a crafted ELF file, as demonstrated by objdump.(CVE-2018-7643)

concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted binary file, as demonstrated by nm-new.(CVE-2018-10373)

The elf_object_p function in elfcode.h in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29.1, has an unsigned integer overflow because bfd_size_type multiplication is not used. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.(CVE-2018-6323)

An integer wraparound has been discovered in the Binary File Descriptor (BFD) library distributed in GNU Binutils up to version 2.30. An attacker could cause a crash by providing an ELF file with corrupted DWARF debug information.(CVE-2018-7569)

The Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted ELF file, as demonstrated by _bfd_elf_parse_attributes in elf-attrs.c and bfd_malloc in libbfd.c. This can occur during execution of nm.(CVE-2018-13033)

process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted binary file, as demonstrated by readelf.(CVE-2018-10372)

In the coff_pointerize_aux function in coffgen.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, an index is not validated, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted file, as demonstrated by objcopy of a COFF object.(CVE-2018-7208)

Security Fix(es) :

  - binutils: Improper bounds check in     coffgen.c:coff_pointerize_aux() allows for denial of     service when parsing a crafted COFF file (CVE-2018-7208)

  - binutils: integer overflow via an ELF file with corrupt     dwarf1 debug information in libbfd library     (CVE-2018-7568)

  - binutils: integer underflow or overflow via an ELF file     with a corrupt DWARF FORM block in libbfd library     (CVE-2018-7569)

  - binutils: NULL pointer dereference in swap_std_reloc_in     function in aoutx.h resulting in crash (CVE-2018-7642)

  - binutils: Integer overflow in the display_debug_ranges     function resulting in crash (CVE-2018-7643)

  - binutils: Crash in elf.c:bfd_section_from_shdr() with     crafted executable (CVE-2018-8945)

  - binutils: Heap-base buffer over-read in     dwarf.c:process_cu_tu_index() allows for denial of     service via crafted file (CVE-2018-10372)

  - binutils: NULL pointer dereference in     dwarf2.c:concat_filename() allows for denial of service     via crafted file (CVE-2018-10373)

  - binutils: out of bounds memory write in peXXigen.c files     (CVE-2018-10534)

  - binutils: NULL pointer dereference in elf.c     (CVE-2018-10535)

  - binutils: Uncontrolled Resource Consumption in execution     of nm (CVE-2018-13033)

An update for binutils is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

The binutils packages provide a collection of binary utilities for the manipulation of object code in various object file formats. It includes the ar, as, gprof, ld, nm, objcopy, objdump, ranlib, readelf, size, strings, strip, and addr2line utilities.

Security Fix(es) :

* binutils: Improper bounds check in coffgen.c:coff_pointerize_aux() allows for denial of service when parsing a crafted COFF file (CVE-2018-7208)

* binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library (CVE-2018-7568)

* binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library (CVE-2018-7569)

* binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash (CVE-2018-7642)

* binutils: Integer overflow in the display_debug_ranges function resulting in crash (CVE-2018-7643)

* binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable (CVE-2018-8945)

* binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via crafted file (CVE-2018-10372)

* binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted file (CVE-2018-10373)

* binutils: out of bounds memory write in peXXigen.c files (CVE-2018-10534)

* binutils: NULL pointer dereference in elf.c (CVE-2018-10535)

* binutils: Uncontrolled Resource Consumption in execution of nm (CVE-2018-13033)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3032 advisory.

    [2.27-34.base.0.1]
    - Backport of upstream commit a5def14f1ca70e14d9433cb229c9369fa3051598       Add a test for R_386_GOT32/R_386_GOT32X IFUNC reloc error [Orabug 27930573]

    [2.27-34.base]
    - Fix seg-fault parsing corrupt AOUT format files.  (#1579799)
    - Fix seg-fault parsing corrupt DWARF2 debug information.  (#1579802)
    - Fix seg-fault parsing corrupt ELF format files.  (#1579801)

    [2.27-33.base]
    - Fix seg-fault parsing ELF files.  (#1578979)
    - Fix seg-fault parsing DWARF-2 information.  (#1579065)
    - Fix seg-fault parsing DWARF-2 information.  (#1579051)
    - Fix seg-fault parsing a PE format file.  (#1579019)

    [2.27-32.base]
    - Fix seg-fault parsing DWARF-1 information.  (#1569580)
    - Fix seg-fault parsing DWARF-2 information.  (#1569891)
    - Fix seg-fault parsing COFF files.  (#1571917)

    [2.27-31.base]
    - Allow 'lea foo@GOT, %reg' in PIC mode on the x86.  (#1573872)

    [2.27-30.base]
    - Version bump in order to allow a rebuild, in order to work around a transient problem with the compose     database.

    [2.27-29.base]
    - Add support for the GLOBALAUDIT dynamic linker tag.
      (#1439351)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3032 advisory.

  - binutils: Improper bounds check in coffgen.c:coff_pointerize_aux() allows for denial of service when     parsing a crafted COFF file (CVE-2018-7208)

  - binutils: integer overflow via an ELF file with corrupt dwarf1 debug information in libbfd library     (CVE-2018-7568)

  - binutils: integer underflow or overflow via an ELF file with a corrupt DWARF FORM block in libbfd library     (CVE-2018-7569)

  - binutils: NULL pointer dereference in swap_std_reloc_in function in aoutx.h resulting in crash     (CVE-2018-7642)

  - binutils: Integer overflow in the display_debug_ranges function resulting in crash (CVE-2018-7643)

  - binutils: Crash in elf.c:bfd_section_from_shdr() with crafted executable (CVE-2018-8945)

  - binutils: Heap-base buffer over-read in dwarf.c:process_cu_tu_index() allows for denial of service via     crafted file (CVE-2018-10372)

  - binutils: NULL pointer dereference in dwarf2.c:concat_filename() allows for denial of service via crafted     file (CVE-2018-10373)

  - binutils: out of bounds memory write in peXXigen.c files (CVE-2018-10534)

  - binutils: NULL pointer dereference in elf.c (CVE-2018-10535)

  - binutils: Uncontrolled Resource Consumption in execution of nm (CVE-2018-13033)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203822	Photon OS 3.0: Crash PHSA-2023-3.0-0601	Nessus	PhotonOS Local Security Checks	critical
203529	Photon OS 4.0: Crash PHSA-2023-4.0-0414	Nessus	PhotonOS Local Security Checks	critical
200048	RHEL 6 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
200030	RHEL 8 : binutils (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195444	RHEL 8 : binutils (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
151919	Ubuntu 16.04 ESM : GNU binutils vulnerabilities (USN-4336-2)	Nessus	Ubuntu Local Security Checks	critical
135966	Ubuntu 18.04 LTS : GNU binutils vulnerabilities (USN-4336-1)	Nessus	Ubuntu Local Security Checks	critical
127559	GLSA-201908-01 : Binutils: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
127252	NewStart CGSL CORE 5.04 / MAIN 5.04 : binutils Multiple Vulnerabilities (NS-SA-2019-0060)	Nessus	NewStart CGSL Local Security Checks	high
121047	Amazon Linux 2 : binutils (ALAS-2019-1138)	Nessus	Amazon Linux Local Security Checks	high
119179	Scientific Linux Security Update : binutils on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	high
118983	CentOS 7 : binutils (CESA-2018:3032)	Nessus	CentOS Local Security Checks	high
118762	Oracle Linux 7 : binutils (ELSA-2018-3032)	Nessus	Oracle Linux Local Security Checks	high
118514	RHEL 7 : binutils (RHSA-2018:3032)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-13033

medium

Tenable Plugins

critical

critical

critical

high

critical

critical

critical

critical

high

high

high

high

high

high