CVE-2017-15368 : Security Advisory and Response

The wasm_dis function in the file wasm.c within the radare2 2.0.0 library allows attackers to remotely cause a denial of service, resulting in a stack-based buffer over-read and application crash. This can be accomplished by exploiting a flaw in the r_hex_bin2str call through the manipulation of a specially crafted WASM file. It is also possible that this vulnerability may have additional unspecified impacts.

Understanding CVE-2017-15368

The vulnerability in radare2 2.0.0 can lead to a denial of service and potential unspecified impacts when manipulated through a specially crafted WASM file.

What is CVE-2017-15368?

The wasm_dis function in radare2 2.0.0 allows remote attackers to trigger a denial of service and potentially other impacts via a crafted WASM file.

The Impact of CVE-2017-15368

Remote attackers can cause a denial of service by exploiting the vulnerability
Possibility of unspecified additional impacts

Technical Details of CVE-2017-15368

The technical details of the vulnerability in radare2 2.0.0.

Vulnerability Description

The flaw in the r_hex_bin2str call within the wasm_dis function can lead to a stack-based buffer over-read and application crash.

Affected Systems and Versions

Affected Version: radare2 2.0.0

Exploitation Mechanism

Attackers can exploit the vulnerability by manipulating a specially crafted WASM file.

Mitigation and Prevention

Steps to mitigate and prevent the CVE-2017-15368 vulnerability.

Immediate Steps to Take

Update radare2 to a non-vulnerable version
Avoid opening untrusted WASM files

Long-Term Security Practices

Regularly update software and libraries
Implement code reviews and security testing

Patching and Updates

Apply patches provided by radare2 to fix the vulnerability