CVE-2022-37331
📋 TL;DR
An out-of-bounds write vulnerability in Open Babel's Gaussian format orientation functionality allows arbitrary code execution when processing malicious files. This affects Open Babel 3.1.1 and development versions, potentially impacting any application or service that uses Open Babel for chemical file format conversion.
💻 Affected Systems
- Open Babel
📦 What is this software?
Open Babel by Openbabel
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Local privilege escalation or application compromise when users process untrusted chemical files.
If Mitigated
Denial of service or application crash if memory protections prevent code execution.
🎯 Exploit Status
Exploitation requires user to process a malicious Gaussian format file; Talos Intelligence has published detailed analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Open Babel 3.1.2 or later
Vendor Advisory: https://github.com/openbabel/openbabel/security/advisories
Restart Required: Yes
Instructions:
1. Update Open Babel to version 3.1.2 or later. 2. Recompile any applications using Open Babel libraries. 3. Restart affected services.
🔧 Temporary Workarounds
Disable Gaussian format processing
allRemove or disable Gaussian format support in Open Babel configuration
# Recompile Open Babel with --disable-gaussian flag
# Or modify configuration to reject .gau/.gjf files
Input validation
allImplement strict file validation before passing to Open Babel
# Add file type verification in calling applications
# Reject files with suspicious Gaussian format characteristics
🧯 If You Can't Patch
- Implement strict file upload controls and sandbox Open Babel processing
- Use application allowlisting to prevent execution of unknown binaries
🔍 How to Verify
Check if Vulnerable:
Check Open Babel version: obabel -V. If version is 3.1.1 or development version around commit 530dbfa3, system is vulnerable.Check Version:
obabel -VVerify Fix Applied:
Verify Open Babel version is 3.1.2 or later: obabel -V | grep -q '3.1.[2-9]\|3.[2-9]'📡 Detection & Monitoring
Log Indicators:
- Open Babel process crashes with segmentation faults
- Unexpected child process spawning from Open Babel
- Abnormal file processing of Gaussian format files
Network Indicators:
- File uploads with Gaussian format extensions (.gau, .gjf) to processing services
SIEM Query:
process_name:"obabel" AND (event_type:"crash" OR parent_process:"obabel")