0

https://trailofbits.github.io/ctf/vulnerabilities/source.html

It says

"Common examples include libraries like libxml, libpng, libpoppler, and libfreetype that parse complicated file formats and protocols."

Do such vulnerabilities surely cause security problems? For example, if the library is linked to a binary that does not have root permission, what damage the binary can cause to the system on which the binary runs?

Improve this question
4
  • 2
    That's like asking, "if someone gets in my car but doesn't have the car key, can they cause any damage?"
    – Conor Mancone
    Mar 25, 2021 at 14:53
  • The answer: absolutely!
    – Conor Mancone
    Mar 25, 2021 at 14:54
  • The analogy is OK to show the risk. But my question is how to ensure the damage must occur. But practically, it may not matter if he just has the car key without knowing which car it is for. I am basically asking how to know which car this key belongs to if you raise this analogy.
    – user1424739
    Mar 25, 2021 at 16:28
  • 2
    @user1424739 your comment makes no sense and you have mutated the analogy. Can you unpack your comment to explain what you mean?
    – schroeder ♦
    Mar 25, 2021 at 17:03

2 Answers 2

Reset to default
2

Let's talk specifics.

A version of libxml (the first item in your list) has a CVSS score of 10 allowing for a buffer overflow leading to remote code execution and denial of service.

Let's assume that the binary that used this library is not run with elevated permissions.

Now let's re-ask your question:

Does such a vulnerability cause security problems?

Quite obviously yes.

  • The DoS is a security problem in that a remote attacker can stop the service at will.
  • Exploiting the vulnerability remotely allows an attacker to run commands as the user the binary was run as. You do not need to be root to do damage or to gain unauthorised access.

Not all vulnerabilities are about gaining root/system access and "total pwnage". Security is not "all or nothing". However, depending on how the system is designed, it is also possible for the misuse/abuse of a non-privileged account to result in privileged access.

Improve this answer
7
  • 1
    There are many, many, many cases where operating as a lowly user is more dangerous than operating as root. If I'm targeting a server the first thing I'm doing to do is figure out how to find what access credentials it uses for 3rd party systems, and I don't need to be root to do that! Now my non-privileged access has allowed me to break into even more, completely unrelated systems
    – Conor Mancone
    Mar 25, 2021 at 17:37
  • 1
    Honestly, root access on your typical web application server is probably the last thing I care about.
    – Conor Mancone
    Mar 25, 2021 at 17:37
  • This is still not specific enough. Just by checking CVE-2017-7376 webpage, I don't see which line of libxml code causes the vulnerability. Also, a binary using libxml does not necessarily use the particular line of code that contains the vulnerability. If it doesn't use that particular line of code, then it is not vulnerable wrt to CVE-2017-7376? Also, CVE-2017-7376 is only about the source code of libxml if I understand it correctly. If this is case, what if the OS has some other ways to mitigate the vulnerability. Does "buffer overflow" guaranteed to cause DoS and remote code execution?
    – user1424739
    Mar 25, 2021 at 17:39
  • 1
    I literally just explained the damage: DoS and RCE. Your question, as asked, does not require the specific line to be analysed. If you want to know how the specific lines in the mentioned libaries can cause specific damage, then that is not what you asked.
    – schroeder ♦
    Mar 25, 2021 at 18:18
  • 1
    And if that's what you really want to know, then the question is off-topic. We would need to know the specific vulnerability you are talking about, the context in which it is used, and the system it is run on. Then we could devise the specific damage that could be done by that specific piece of code in that specific context. And code analysis is not what we do here.
    – schroeder ♦
    Mar 25, 2021 at 18:21
1

Yes! These absolutely can cause security problems.

You may think the risk is limited to that binary, where the damage could be anything that binary has control over or access to, but you should read up on privilege escalation - attackers will happily begin with anything that they can exploit, but once they have limited access they then work to gain greater access, either on the same machine or account, or by moving to another.

Think of it as a foot in the door. It's better to have the door shut and locked than have an attacker have a foot in and working out what they can reach from there.

MITRE has many techniques described for escalating privilege.

Improve this answer
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .