SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
Cory Duplantis of Cisco Talos unearthed a LabVIEW code execution flaw which can be triggered by the victim opening a specially crafted VI file.
LabVIEW, the widely used system design and development platform developed by National Instruments, sports a memory corruption vulnerability that could lead to code execution.
LabVIEW is commonly used for building data acquisition, instrument control, and industrial automation systems on a variety of operating systems: Windows, macOS, Linux and Unix.
The vulnerability was discovered by Cory Duplantis of Cisco Talos earlier this year, and reported to the company.
It can be triggered by the victim opening a specially crafted VI file – a proprietary file format that's comparable to the EXE file format.
"Although there is no published specification for the [VI] file format, inspecting the files shows that they contain a section named 'RSRC', presumably containing resource information," Cisco noted.
"Modulating the values within this section of a VI file can cause a controlled looping condition resulting in an arbitrary null write. This vulnerability can be used by an attacker to create a specially crafted VI file that when opened results in the execution of code supplied by the attacker. The consequences of a successful compromise of a system that interacts with the physical world, such as a data acquisition and control systems, may be critical to safety."
More details about the flaw can be found in this report. It affects the latest stable LabVIEW version (LabVIEW 2016 version 16.0), but it's possible that earlier iterations are also vulnerable.
Additional Information:
http://blog.talosintelligence.com/2017/08/vulnerability-spotlight-code-execution.html
CVE-2017-2779
Source: https://www.helpnetsecurity.com/2017/08/30/labview-code-execution-flaw/
(Score: 1, Insightful) by Anonymous Coward on Thursday August 31 2017, @12:11PM (6 children)
what's not to love about proprietary software?
(Score: 0) by Anonymous Coward on Thursday August 31 2017, @01:20PM
What's not to love about software thrown together by volunteers?
(Score: 1, Touché) by Anonymous Coward on Thursday August 31 2017, @02:14PM (2 children)
It might seem a bit self-defeating to preface such a comment with "WONTFIX", a term popularized by Mozilla.org and later the systemd developers.
(Score: 0) by Anonymous Coward on Thursday August 31 2017, @05:46PM (1 child)
The point of free software is you're not at the mercy of the developer. They can say no but you can still do it yourself or hire muscle to.
(Score: -1, Troll) by Anonymous Coward on Thursday August 31 2017, @07:26PM
Anybody in the known about reverse engineering can still fix it and issue a binary patch. And don't give me that legal smegal stuff, people have been doing that with legacy windows versions for decades.
(Score: -1, Flamebait) by Anonymous Coward on Thursday August 31 2017, @07:44PM (1 child)
When that WONTFIX from the proprietary vendor causes a local coven of feminists to identify you (you! not your fucking employer who bought the software! not the fucking vendor! YOU! PERSONALLY!!!! YOU, JUST WORKING FOR SHIT PER HOUR WITH NO MANAGEMENT AUTHORITY, JUST TRYING TO PAY YOUR DAMNED BILLS EVERY FUCKING GODDESS DAMNED MONTH LIKE EVERYBODY FUCKING ELSE) as a misogynist, which when you're trans and a judgement like that gets handed down on you suddenly makes the normal difficulties with health care access trans folks face a whole new level of horseshit....
I don't know. FUCK FEMINISM, AND FUCK PROPRIETARY SOFTWARE.
FEMINISM AND PROPRIETARY SOFTWARE CAN BURN IN HELL.
(Score: 2, Funny) by Azuma Hazuki on Thursday August 31 2017, @08:51PM
Hi Kurenai. You forgot to log in. Daily reminder than most feminists aren't TERFs and the Michigan Womyn's Music Festival is to feminism what the Dominionists are to Protestant Christianity. Smoke a bowl and c-h-i-l-l.
I am "that girl" your mother warned you about...