Re: Buffer Overflow in graphviz via via a crafted config6a file

[Matthew Fernandez <matthew.fernandez () gmail com>]

On 1/20/24 15:07, Meng Ruijie wrote:
> [Vulnerability description]
> Buffer Overflow vulnerability in graphviz v.2.43.0 allows a remote attacker to execute arbitrary code via a crafted 
> config6a file.
>
> [Vulnerability Type]
> Buffer Overflow

More specifically, this issue is an out-of-bounds read.

> [Vendor of Product]
> graphviz
>
> [Affected Product Code Base]
> graphviz - 2.43.0

AFAICT the issue was actually introduced in Graphviz 2.36. It was fixed 
in commit a95f977f5d809915ec4b14836d2b5b7f5e74881e (essentially 
reverting cf95714837f06f684929b54659523c2c9b1fc19f that introduced the 
issue), but there has been no release yet since then. The next release 
will be 10.0.0. So affected versions would be [2.36, 10.0.0).

To exploit this issue, you need to modify a typically-root-owned file. I 
am not suggesting it is hard to exploit, but see my remarks below.

> [CVE Reference]
> The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46045 to this 
> vulnerability.

Why was this issue gifted a CVE? If you want an out-of-bounds access in 
Graphviz, there is much lower hanging fruit.

As Alan Coopersmith has noted in a separate thread,¹ this stream of 
issues seems to have been bulk-created without much analysis. The CVE 
details still appear to be RESERVED in NVD. The Graphviz maintainers do 
not intend to contest this CVE, but I expect the details to be 
inaccurate when released as I’ve noted above.

¹ https://seclists.org/oss-sec/2024/q1/59
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/