CVE-2019-19787
📋 TL;DR
CVE-2019-19787 is a stack-based buffer overflow vulnerability in ATasm 1.06 that occurs when processing malicious .m65 files. Attackers can exploit this to execute arbitrary code or crash the application. Users of ATasm 1.06 who process untrusted .m65 files are affected.
💻 Affected Systems
- ATasm
📦 What is this software?
Atasm by Atasm Project
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the ATasm process, potentially leading to full system compromise if ATasm runs with elevated privileges.
Likely Case
Application crash (denial of service) or limited code execution within the context of the ATasm process.
If Mitigated
No impact if ATasm is not used to process untrusted .m65 files or if the vulnerable version is not deployed.
🎯 Exploit Status
Exploitation requires the victim to process a crafted .m65 file. The bug report on SourceForge includes technical details that could facilitate exploit development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ATasm 1.07 or later
Vendor Advisory: https://sourceforge.net/p/atasm/bugs/10/
Restart Required: No
Instructions:
1. Download ATasm 1.07 or later from the official SourceForge repository. 2. Replace the existing ATasm binary with the updated version. 3. Verify the version with 'atasm --version'.
🔧 Temporary Workarounds
Avoid processing untrusted .m65 files
allDo not use ATasm to assemble or process .m65 files from untrusted sources.
🧯 If You Can't Patch
- Restrict ATasm usage to trusted users only and audit .m65 file sources.
- Run ATasm in a sandboxed or isolated environment with minimal privileges.
🔍 How to Verify
Check if Vulnerable:
Check ATasm version: if it's exactly 1.06, it's vulnerable. Use 'atasm --version' or check the installed package version.Check Version:
atasm --versionVerify Fix Applied:
After updating, run 'atasm --version' and confirm the version is 1.07 or higher.📡 Detection & Monitoring
Log Indicators:
- ATasm crash logs or core dumps when processing .m65 files
- Unexpected process termination of ATasm
Network Indicators:
- Not applicable - local file processing vulnerability
SIEM Query:
Process monitoring for ATasm crashes or abnormal termination events.🔗 References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
- https://sourceforge.net/p/atasm/bugs/10/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KUABDG4CEAY2FVPM3CFFCZMOKSTEKGXX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O6XQMOLMWHUDBN3PQJYGVULLNUBMGGJH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJYUV3PKSIGBZGJ6PXAGTT2LW6HLPMS/
- https://sourceforge.net/p/atasm/bugs/10/
