CVE-2017-2780: inside secure matrixssl Out-of-bounds Write

Vulnerability summary

CVE-2017-2780 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in inside secure matrixssl. EPSS estimates a 2.34% chance of exploitation in the next 30 days, higher than 83.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 22-06-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability, a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection.

• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.