CVE-2014-9273
published 2014-12-08CVE-2014-9273: lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds…
PriorityP425medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EPSS
0.63%
45.9th percentile
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | hivex | < hivex 1.3.11-1 (bookworm) | hivex 1.3.11-1 (bookworm) |
| debian | hivex | <= 1.3.10-2 | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_hpc_node | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | hivex | >= 0 < 1.3.11-1 | 1.3.11-1 |
| redhat | hivex | >= 0 < 1.3.11-1 | 1.3.11-1 |
| redhat | hivex | >= 0 < 1.3.11-1 | 1.3.11-1 |
| redhat | hivex | >= 0 < 1.3.11-1 | 1.3.11-1 |
CVSS provenance
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv4.6MEDIUM
vendor_debian4.6LOW
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qvqq-v774-hxcg: lib/handle
ghsa_unreviewed·2022-05-14
CVE-2014-9273 [MEDIUM] CWE-119 GHSA-qvqq-v774-hxcg: lib/handle
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
OSV
CVE-2014-9273: lib/handle
osv·2014-12-08·CVSS 4.6
CVE-2014-9273 [MEDIUM] CVE-2014-9273: lib/handle
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Red Hat
hivex: missing checks for small-sized files
vendor_redhat·2014-10-29·CVSS 4.6
CVE-2014-9273 [MEDIUM] CWE-120 hivex: missing checks for small-sized files
hivex: missing checks for small-sized files
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
It was found that hivex attempted to read, and possibly write, beyond its allocated buffer when reading a hive file with a very small size or with a truncated or improperly formatted content. An attacker able to supply a specially crafted hive file to an application using the hivex library could possibly use this flaw to execute arbitrary code with the privileges of the user running that application.
Debian
CVE-2014-9273: hivex - lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code...
vendor_debian·2014·CVSS 4.6
CVE-2014-9273 [MEDIUM] CVE-2014-9273: hivex - lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code...
lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write.
Scope: local
bookworm: resolved (fixed in 1.3.11-1)
bullseye: resolved (fixed in 1.3.11-1)
forky: resolved (fixed in 1.3.11-1)
sid: resolved (fixed in 1.3.11-1)
trixie: resolved (fixed in 1.3.11-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-9273 hivex: missing checks for small-sized files
bugzilla·2014-11-25·CVSS 4.6
CVE-2014-9273 [MEDIUM] CVE-2014-9273 hivex: missing checks for small-sized files
CVE-2014-9273 hivex: missing checks for small-sized files
It was reported that hivex [1], a library that can read and write hive files (undocumented binary files that Windows uses to store the Windows Registry on disk), did not properly handle small-sized hive files. An attacker able to supply a hive file of a small size to an application using the hivex library could use this flaw to read, and possibly write, up to 4095 bytes beyond the end of the allocated buffer, potentially resulting in arbitrary code execution with the with the privileges of the user running that application.
This issue has been fixed in upstream version 3.11 of hivex. Upstream patches are available at:
https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adb
https://github.com/libguestfs
Bugzilla
CVE-2014-9273 hivex: missing checks for small/truncated files [rhel-6.7]
bugzilla·2014-10-30·CVSS 4.6
CVE-2014-9273 [MEDIUM] CVE-2014-9273 hivex: missing checks for small/truncated files [rhel-6.7]
CVE-2014-9273 hivex: missing checks for small/truncated files [rhel-6.7]
+++ This bug was initially created as a clone of Bug #1158992 +++
Description of problem:
This issue was discovered and reported by Mahmoud Al-Qudsi, here:
https://www.redhat.com/archives/libguestfs/2014-October/thread.html#00235
If you present hivex with a too-small file, or certain truncated
or improperly formed files, then it will (at least) try to read
from beyond its allocated buffer. It may even try to write, but
we didn't prove that.
Version-Release number of selected component (if applicable):
All versions of hivex small
$ valgrind hivexsh -w small
[...]
==7030== Invalid read of size 1
==7030== at 0x4E33EBC: hivex_open (in /usr/lib64/libhivex.so.0.0.0)
==7030== by 0x4033B8: ??? (in /usr/bin/hivexsh)
==70
Bugzilla
CVE-2014-9273 hivex: missing checks for small-sized files [rhel-7.1]
bugzilla·2014-10-30·CVSS 4.6
CVE-2014-9273 [MEDIUM] CVE-2014-9273 hivex: missing checks for small-sized files [rhel-7.1]
CVE-2014-9273 hivex: missing checks for small-sized files [rhel-7.1]
Description of problem:
This issue was discovered and reported by Mahmoud Al-Qudsi, here:
https://www.redhat.com/archives/libguestfs/2014-October/thread.html#00235
If you present hivex with a too-small file, or certain truncated
or improperly formed files, then it will (at least) try to read
from beyond its allocated buffer. It may even try to write, but
we didn't prove that.
Version-Release number of selected component (if applicable):
All versions of hivex small
$ valgrind hivexsh -w small
[...]
==7030== Invalid read of size 1
==7030== at 0x4E33EBC: hivex_open (in /usr/lib64/libhivex.so.0.0.0)
==7030== by 0x4033B8: ??? (in /usr/bin/hivexsh)
==7030== by 0x401B54: ??? (in /usr/bin/hivexsh)
==7030== by 0x52ACAF4: (bel
http://lists.opensuse.org/opensuse-updates/2015-02/msg00005.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0301.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1378.htmlhttp://secunia.com/advisories/62792http://www.openwall.com/lists/oss-security/2014/11/25/6http://www.openwall.com/lists/oss-security/2014/12/04/14http://www.securityfocus.com/bid/71279https://bugzilla.redhat.com/show_bug.cgi?id=1167756https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adbhttps://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705https://security.gentoo.org/glsa/201503-07https://www.redhat.com/archives/libguestfs/2014-October/msg00235.htmlhttp://lists.opensuse.org/opensuse-updates/2015-02/msg00005.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0301.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1378.htmlhttp://secunia.com/advisories/62792http://www.openwall.com/lists/oss-security/2014/11/25/6http://www.openwall.com/lists/oss-security/2014/12/04/14http://www.securityfocus.com/bid/71279https://bugzilla.redhat.com/show_bug.cgi?id=1167756https://github.com/libguestfs/hivex/commit/357f26fa64fd1d9ccac2331fe174a8ee9c607adbhttps://github.com/libguestfs/hivex/commit/4bbdf555f88baeae0fa804a369a81a83908bd705https://security.gentoo.org/glsa/201503-07https://www.redhat.com/archives/libguestfs/2014-October/msg00235.html
2014-12-08
Published