CVE-2017-2780 Memory corruption in MatrixSSL
A heap buffer overflow in MatrixSSL allows remote code execution via a crafted X509 certificate during secure connection initiation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-2780?
CVE-2017-2780 is a high-severity memory corruption vulnerability in Inside Secure MatrixSSL, published on 22 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection.
Weakness: CWE-787
Which versions are affected by CVE-2017-2780?
It affects 1 product.
Products include Matrixssl Matrixssl.
How do I fix CVE-2017-2780?
No fix has been published for CVE-2017-2780 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-2780 being exploited?
There is no known exploitation of CVE-2017-2780 in the wild and no public exploit code.
Other vulnerabilities in Inside Secure MatrixSSL
Sources
Also known as GHSA-qv8w-rwpg-f5xp.