CVE-2017-3158 Apache Guacamole Race Condition vulnerability
A race condition in Apache Guacamole's terminal emulator allows buffer overflows via overlapping writes, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-3158?
CVE-2017-3158 is a high-severity vulnerability in Apache Guacamole, published on 18 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.
Weakness: CWE-362
Which versions are affected by CVE-2017-3158?
2 open source packages ship an affected version, including org.apache.guacamole:guacamole-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.guacamole:guacamole-common Maven | From 0.9.5 | 0.9.11-incubating |
org.apache.guacamole:guacamole-common Maven | From 0.9.5 | 0.9.11-incubating |
Products include Apache Guacamole.
How do I fix CVE-2017-3158?
Upgrade org.apache.guacamole:guacamole-common to 0.9.11-incubating or later.
Is CVE-2017-3158 being exploited?
There is no known exploitation of CVE-2017-3158 in the wild and no public exploit code.
Other vulnerabilities in Apache Guacamole
- CVE-2021-43999 Improper validation of SAML responses
- CVE-2023-43826 Apache Guacamole: Integer overflow in handling of VNC image buffers
- CVE-2019-19603 Null dereference in n/a
- CVE-2018-1340 Missing Encryption of Sensitive Data in Apache Guacamole
- CVE-2024-35164 Apache Guacamole: Improper input validation of console codes
Sources
Also known as GHSA-3vv3-585q-wv6x, UBUNTU-CVE-2017-3158.