GNU Binutils CVE-2019-9077 Heap Buffer Overflow Vulnerability

GNU Binutils is prone to a heap-based buffer-overflow vulnerability.

Attackers can exploit this issue to cause a denial-of-service condition, denying service to legitimate users. Given the nature of this issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.
GNU Binutils 2.32 is vulnerable; other versions may also be affected.

Information

Bugtraq ID: 107139
Class: Boundary Condition Error
CVE: CVE-2019-9077

Remote: Yes
Local: No
Published: Feb 23 2019 12:00AM
Updated: Feb 23 2019 12:00AM
Credit: spinpx
Vulnerable: GNU Binutils 2.32

Not Vulnerable:

Exploit

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

References:

• Binutils Home Page (GNU)
  
• Bug 24243 - readelf: heap buffer overflow in process_mips_specific (Sourceware)
  
• Fix a illegal memory access fault when parsing a corrupt MIPS option section (Sourceware)
  

Source: www.securityfocus.com