Lucene search

K
ubuntucveUbuntu.comUB:CVE-2018-14779
HistoryAug 15, 2018 - 12:00 a.m.

CVE-2018-14779

2018-08-1500:00:00
ubuntu.com
ubuntu.com
14

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.1%

A buffer overflow issue was discovered in the Yubico-Piv 1.5.0 smartcard
driver. The file lib/ykpiv.c contains the following code in the function
ykpiv_transfer_data(): {% highlight c %} if(*out_len + recv_len - 2 >
max_out) { fprintf(stderr, “Output buffer to small, wanted to write %lu,
max was %lu.”, *out_len + recv_len - 2, max_out); } if(out_data) {
memcpy(out_data, data, recv_len - 2); out_data += recv_len - 2; *out_len +=
recv_len - 2; } {% endhighlight %} – it is clearly checked whether the
buffer is big enough to hold the data copied using memcpy(), but no error
handling happens to avoid the memcpy() in such cases. This code path can
be triggered with malicious data coming from a smartcard.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchyubico-piv-tool< 1.4.2-2ubuntu0.1UNKNOWN
ubuntu16.04noarchyubico-piv-tool< 1.0.3-1ubuntu0.1~esm1UNKNOWN

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.1%