CVE Vulnerabilities

CVE-2017-9304

Uncontrolled Recursion

Published: May 31, 2017 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM

libyara/re.c in the regexp module in YARA 3.5.0 allows remote attackers to cause a denial of service (stack consumption) via a crafted rule that is mishandled in the _yr_re_emit function.

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Yara Virustotal 3.5.0 (including) 3.5.0 (including)
Yara Ubuntu artful *
Yara Ubuntu esm-apps/xenial *
Yara Ubuntu trusty *
Yara Ubuntu upstream *
Yara Ubuntu xenial *
Yara Ubuntu yakkety *
Yara Ubuntu zesty *

Potential Mitigations

References