Versions through 9.0.4 of the Ghidra software reverse engineering (SRE) framework are impacted by a code-execution vulnerability, the National Security Agency (NSA) has revealed.
Developed by the NSA’s Research Directorate for the agency’s cybersecurity missions, Ghidra is designed to help with malware analysis. The framework supports multiple platforms, including Windows, macOS, and Linux, and was released in open source earlier this year.
At the end of September, security researchers discovered a vulnerability in the tool that could allow an attacker to execute arbitrary code within the context of the affected application.
Tracked as CVE-2019-16941, the security flaw has a CVSS score of 9.8 and is considered “critical severity.”
The vulnerability only triggers when experimental mode is enabled. The issue exists in the Read XML Files feature of Bit Patterns Explorer and can be exploited using modified XML documents, according to an advisory in the National Vulnerability Database (NVD).
“This occurs in Features/BytePatterns/src/ main/java/ghidra/bitpatterns/info/ FileBitPatternInfoReader.java. An attack could start with an XML document that was originally created by DumpFunctionPatternInfoScript but then directly modified by an attacker (for example, to make a java.lang.Runtime.exec call),” the advisory reads.
The NSA, on the other hand, posted on Twitter that, given the conditions necessary for exploitation are rare, the vulnerability is not a serious issue, as long as the Ghidra user does not accept XMLs from unknown sources.
The agency also revealed that a patch has been released for all those who build Ghidra themselves from the master branch. The fix will be included in the Ghidra 9.1 release, which is currently in beta testing.
Related: NSA Releases Reverse Engineering Tool’s Source Code
Related: Cisco Releases GhIDA and Ghidraaas Tools for IDA Pro
More from Ionut Arghire
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
- Chrome 114 Released With 18 Security Fixes
- Spyware Found in Google Play Apps With Over 420 Million Downloads
- Millions of WordPress Sites Patched Against Critical Jetpack Vulnerability
- PyPI Enforcing 2FA for All Project Maintainers to Boost Security
- Personal Information of 9 Million Individuals Stolen in MCNA Ransomware Attack
Latest News
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Toyota Discloses New Data Breach Involving Vehicle, Customer Information
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Amazon Settles Ring Customer Spying Complaint
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Adobe Inviting Researchers to Private Bug Bounty Program
- Critical Vulnerabilities Found in Faronics Education Software
