NVD Vulnerability Detail

CVE-2018-19497

Summary	In The Sleuth Kit (TSK) through 4.6.4, hfs_cat_traverse in tsk/fs/hfs.c does not properly determine when a key length is too large, which allows attackers to cause a denial of service (SEGV on unknown address with READ memory access in a tsk_getu16 call in hfs_dir_open_meta_cb in tsk/fs/hfs_dent.c).
Publication Date	Nov. 30, 2018, 8:29 a.m.
Registration Date	March 1, 2021, 7:13 p.m.
Last Update	Nov. 21, 2024, 12:58 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:sleuthkit:the_sleuth_kit::::::::			4.6.4

Related information, measures and tools

No	URL	タグ
1	https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d	Patch Third Party Advisory
2	https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d	Patch Third Party Advisory
3	https://github.com/sleuthkit/sleuthkit/pull/1374	Patch Third Party Advisory
4	https://github.com/sleuthkit/sleuthkit/pull/1374	Patch Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2018/12/msg00008.html	Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2018/12/msg00008.html	Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html	Mailing List Third Party Advisory
8	https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html	Mailing List Third Party Advisory
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZXFYOOMSP7NWRTSO4XXGHXAY3CJNAJ6/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZXFYOOMSP7NWRTSO4XXGHXAY3CJNAJ6/
11	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLSVLDQLPGKRHHBPYUXVJJPAID6CYBXD/
12	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NLSVLDQLPGKRHHBPYUXVJJPAID6CYBXD/

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html

JVN Vulnerability Information

The Sleuth Kit における境界外読み取りに関する脆弱性

Title	The Sleuth Kit における境界外読み取りに関する脆弱性
Summary	The Sleuth Kit (TSK) には、境界外読み取りに関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 29, 2018, midnight
Registration Date	Feb. 4, 2019, 5:54 p.m.
Last Update	Feb. 4, 2019, 5:54 p.m.

Affected System

Debian

Debian GNU/Linux

The Sleuth Kit

The Sleuth Kit 4.6.4 まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-19497	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19497
National Vulnerability Database (NVD)
2	CVE-2018-19497	https://nvd.nist.gov/vuln/detail/CVE-2018-19497

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-125	https://cwe.mitre.org/data/definitions/125.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DLA 1610-1] sleuthkit security update	https://lists.debian.org/debian-lts-announce/2018/12/msg00008.html
GitHub
2	Fix CVE-2018-19497. #1374	https://github.com/sleuthkit/sleuthkit/pull/1374
3	Merge pull request #1374 from JordyZomer/develop	https://github.com/sleuthkit/sleuthkit/commit/bc04aa017c0bd297de8a3b7fc40ffc6ddddbb95d

Change Log

No	Changed Details	Date of change
1	[2019年02月04日] 掲載	Feb. 4, 2019, 5:54 p.m.