CVE-2017-2798 : Security Advisory and Response

MarkLogic 8.0-6 contains a heap corruption vulnerability in its Antenna House DMC HTMLFilter, allowing arbitrary code execution via a crafted XLS file.

Understanding CVE-2017-2798

An overview of the vulnerability and its impact.

What is CVE-2017-2798?

This CVE describes a heap corruption vulnerability in the GetIndexArray function of Antenna House DMC HTMLFilter, as utilized by MarkLogic 8.0-6. An attacker can exploit this flaw by providing a specially crafted XLS file, potentially leading to arbitrary code execution.

The Impact of CVE-2017-2798

The vulnerability has a CVSS base score of 8.3 (High severity) with high impacts on confidentiality, integrity, and availability. It requires no privileges and user interaction is necessary for exploitation.

Technical Details of CVE-2017-2798

Insight into the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability exists in the GetIndexArray function of Antenna House DMC HTMLFilter, enabling heap corruption when processing malicious XLS files.

Affected Systems and Versions

Product: DMC HTMLFilter
Vendor: Antenna House
Versions: as shipped with MarkLogic 8.0-6

Exploitation Mechanism

The vulnerability can be exploited by providing a specifically crafted XLS file to trigger heap corruption and execute arbitrary code.

Mitigation and Prevention

Measures to mitigate and prevent exploitation of CVE-2017-2798.

Immediate Steps to Take

Apply vendor patches or updates promptly.
Avoid opening XLS files from untrusted or unknown sources.
Implement network security measures to detect and block malicious files.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Conduct security training to educate users on identifying and handling suspicious files.

Patching and Updates

Antenna House and MarkLogic may release patches to address the vulnerability. Stay informed about security updates and apply them as soon as they are available.