CVE-2019-17362
📋 TL;DR
CVE-2019-17362 is a buffer overflow vulnerability in LibTomCrypt's UTF-8 DER decoding function that allows attackers to cause denial of service or read sensitive memory contents. Any application using LibTomCrypt versions through 1.18.2 to process DER-encoded data is potentially affected. This vulnerability can be triggered by specially crafted DER-encoded UTF-8 strings.
💻 Affected Systems
- LibTomCrypt
- Applications using LibTomCrypt library
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this would require additional memory corruption exploitation techniques beyond the initial out-of-bounds read.
Likely Case
Denial of service through application crashes and potential information disclosure via memory content leakage.
If Mitigated
Limited impact with proper input validation and memory protection mechanisms in place, potentially preventing successful exploitation.
🎯 Exploit Status
Exploitation requires sending specially crafted DER-encoded data to applications using the vulnerable function. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.3 and later
Vendor Advisory: https://github.com/libtom/libtomcrypt/issues/507
Restart Required: Yes
Instructions:
1. Update LibTomCrypt to version 1.18.3 or later. 2. Recompile and redeploy any applications using LibTomCrypt. 3. Restart affected services.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for DER-encoded data before passing to LibTomCrypt functions
Memory Protection
linuxEnable ASLR and other memory protection mechanisms to reduce exploit impact
echo 2 > /proc/sys/kernel/randomize_va_space
🧯 If You Can't Patch
- Implement network filtering to block or inspect DER-encoded data
- Isolate vulnerable systems from untrusted networks and users
🔍 How to Verify
Check if Vulnerable:
Check LibTomCrypt version: ldd on binary or check library version. If version <= 1.18.2 and application uses der_decode_utf8_string, it's vulnerable.Check Version:
strings /path/to/libtomcrypt.so | grep -i versionVerify Fix Applied:
Verify LibTomCrypt version is >= 1.18.3 and test with known malicious DER-encoded UTF-8 strings📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Memory access violation errors
- Unexpected termination of services using LibTomCrypt
Network Indicators:
- Unusual DER-encoded data patterns in network traffic
- Multiple connection attempts with malformed data
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "memory violation" OR "libtomcrypt")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507
- https://github.com/libtom/libtomcrypt/pull/508
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://vuldb.com/?id.142995
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html
- https://github.com/libtom/libtomcrypt/issues/507
- https://github.com/libtom/libtomcrypt/pull/508
- https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/
- https://vuldb.com/?id.142995
