Skip to content

Commit 932e12c

Browse files
terrikoJohn Andersen
terriko
authored and
John Andersen
committed
Initial release
Signed-off-by: John Andersen <[email protected]>
0 parents  commit 932e12c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+3327
-0
lines changed

Diff for: ‎.coveragerc

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[run]
2+
source =
3+
cve_bin_tool
4+
test
5+
branch = True
6+
7+
[report]
8+
exclude_lines =
9+
no cov
10+
no qa
11+
noqa
12+
pragma: no cover
13+
if __name__ == .__main__.:

Diff for: ‎.gitignore

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
*.swp
2+
*.pyc
3+
__pycache__/
4+
*.extracted
5+
.venv*
6+
*.egg-info/
7+
*.out
8+
htmlcov/
9+
.coverage

Diff for: ‎LICENSE.md

+675
Large diffs are not rendered by default.

Diff for: ‎MANUAL.md

+267
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,267 @@
1+
CVE checker for binary code User Manual
2+
=======================================
3+
4+
This tool scans for a number of common, vulnerable open source components
5+
(openssl, libpng, libxml2, expat and a few others) to let you know if your
6+
system includes common libraries with known vulnerabilities, known as CVEs
7+
(Common Vulnerabilities and Exposures).
8+
9+
Usage:
10+
`cve-bin-tool <flags> <path to directory>`
11+
12+
Possible output levels:
13+
-v (verbose): print scan results as they're found
14+
(regular): print only final summary
15+
-q (quiet): suppress all output but exit with error
16+
number indicating number of files with CVE
17+
18+
Other options:
19+
-x (extract): Autoextract compressed files
20+
21+
For a quick overview of usage and how it works, you can also see [the readme file](README.md).
22+
23+
24+
Table of Contents
25+
-----------------
26+
- [CVE checker for binary code User Manual](#cve-checker-for-binary-code-user-manual)
27+
- [Table of Contents](#table-of-contents)
28+
- [How it works](#how-it-works)
29+
- [Installing](#installing)
30+
- [Fixing Known Issues / What should I do if it finds something?](#fixing-known-issues--what-should-i-do-if-it-finds-something)
31+
- [Limitations](#limitations)
32+
- [Output Samples](#output-samples)
33+
- [Default Mode](#default-mode)
34+
- [Verbose Mode](#verbose-mode)
35+
- [Quiet Mode](#quiet-mode)
36+
- [Feedback & Contributions](#feedback--contributions)
37+
- [Security Issues](#security-issues)
38+
39+
How it works
40+
------------
41+
This scanner looks at the strings found in binary files to see if they
42+
match vulnerable versions of a small set of popular open source libraries.
43+
44+
It does not attempt to exploit issues or examine code in greater detail.
45+
As such, it cannot tell if someone has backported fixes to an otherwise
46+
vulnerable version, it merely provides a mapping between strings, versions, and
47+
known CVEs.
48+
49+
A [list of currently available checkers](checkers/) can be found in the checkers
50+
directory, as can the [instructions on how to add a new
51+
checker](cve_bin_tool/checkers/README.md). Support for new checkers can be requested
52+
via [GitHub
53+
issues](https://github.com/intel/cve-bin-tool/issues).
54+
(Please note, you will need to be logged in to add a new issue.)
55+
56+
57+
This tool gives a list of CVE numbers. For those not familiar with the process, these can be looked up using a number of different tools, such as the [vulnerability search on the CVE Details website](https://www.cvedetails.com/vulnerability-search.php). Each CVE filed contains a short summary of the issue (also printed when you use the -v flag in this tool), a set of severity scores that are combined to make a CVSS score, a list of products known to be affected, and links to more information (which may include links to sample exploits as well as patches to fix the issue).
58+
59+
Installing
60+
----------
61+
62+
`cve-bin-tool` can be installed via pip. If your `PATH` environment variable is
63+
properly configured, installation will result in `cve-bin-tool` being accessible
64+
globally. If not you can treat `cve-bin-tool` as `python -m cve_bin_tool.cli` in
65+
the documentation.
66+
67+
```console
68+
pip install cve-bin-tool
69+
```
70+
71+
If you want the latest and greatest between releases you can grab from GitHub.
72+
73+
```console
74+
pip install git+https://github.com/intel/cve-bin-tool
75+
```
76+
77+
CVE Binary Tool relies on a few command line utilities which are usually present
78+
on GNU/Linux systems but you may need to install.
79+
80+
- file
81+
- strings
82+
- tar
83+
- unzip
84+
- rpm2cpio
85+
- cpio
86+
- ar
87+
- cabextract
88+
89+
Fixing Known Issues / What should I do if it finds something?
90+
-------------------------------------------------------------
91+
92+
The most recommended way to fix a given CVE is to upgrade the package to a
93+
non-vulnerable version. Ideally, a CVE is only made public after a fix is
94+
available, although this is not always the case.
95+
96+
If this is not possible for some reason, search for the CVE number to get
97+
information on possible workarounds and patches that could be backported to
98+
other versions. Note that neither workarounds nor backported fixes can be
99+
detected by this tool, so your binary will continue to show up as vulnerable
100+
even though it may now be safely mitigated and the result a false positive.
101+
102+
Limitations
103+
-----------
104+
105+
When running this script, Python 3 is preferred over Python 2.7. This tool
106+
was developed for Linux and expects a number of common Linux utilities. It
107+
can be run on Windows using cygwin or other option to ensure these utilities
108+
are installed.
109+
110+
This tool does not scan for all possible known public vulnerabilities, it only
111+
scans for specific commonly vulnerable open source components. A complete
112+
list of currently supported library checkers can be found in [the checkers
113+
directory](https://github.com/intel/cve-bin-tool/tree/master/checkers).
114+
115+
As the name implies, this tool is intended for use with binaries. If you have
116+
access to a known list of package names and versions, you may wish to use
117+
another tool such as the [CVE check tool
118+
here](https://github.com/ikeydoherty/cve-check-tool) which covers a larger
119+
database of known public issues.
120+
121+
Output Samples
122+
--------------
123+
124+
The tool has several different output modes, from most information to least as follows:
125+
126+
1. Verbose mode (-v) Prints scan results as they're found (while crawling a directory)
127+
2. Regular mode (no flag) prints only the final summary of findings
128+
3. Quiet mode (-q) suppresses all output but exits with an error number indicating the number of files with known CVEs. This is intended for continuous integration and headless tests, while the other modes are all more human-friendly.
129+
130+
Although the examples in this section show results for a single library to make them shorter and easier to read, the tool was designed to be run on entire directories and will scan all files in a directory if one is supplied.
131+
132+
### Default Mode
133+
134+
The default mode for the cve-bin-tool prints only a final summary of results,
135+
without CVE descriptions or information while the scan is progressing. It
136+
outputs a CSV with the results to stdout. In the form of `package name, version,
137+
CVE number, CVE severity`. Below is an example of it being run on curl:
138+
139+
```
140+
terri@sandia:~/Code/cve-bin-tool$ cve-bin-tool /usr/bin/curl
141+
Connecting to NVD database and extracting the CVE list ... Please hold on.. This
142+
will take few minutes...
143+
Last Update: 2019-01-18
144+
Local database has been updated in the past 24h.
145+
New data not downloaded. Remove old files to force the update.
146+
147+
Overall CVE summary:
148+
There are 1 files with known CVEs detected
149+
Known CVEs in curl 7.58.0:
150+
curl,7.58.0,CVE-2018-0500,CRITICAL
151+
curl,7.58.0,CVE-2018-1000120,CRITICAL
152+
curl,7.58.0,CVE-2018-1000121,HIGH
153+
curl,7.58.0,CVE-2018-1000122,CRITICAL
154+
curl,7.58.0,CVE-2018-1000300,CRITICAL
155+
curl,7.58.0,CVE-2018-1000301,CRITICAL
156+
curl,7.58.0,CVE-2018-16839,CRITICAL
157+
curl,7.58.0,CVE-2018-16842,CRITICAL
158+
```
159+
160+
This mode is meant to give the user enough information that they can
161+
investigate further, but it omits the severity information so that the tool can
162+
run more quickly without the additional database lookups.
163+
164+
### Verbose Mode
165+
The verbose mode is another human-friendly mode. Unlike default mode, it
166+
prints results per file as they're found, as well as printing the final
167+
summary, so you can see its progress as it traverses directories. It also
168+
provides detailed descriptions of the CVEs found including severity so that
169+
users can make educated decisions about the risks of a given out-of-date
170+
library.
171+
172+
> `1/18/2019` Verbose mode currently omits CVE descriptions
173+
174+
Sample output on openssl1.0.2.g:
175+
176+
```
177+
terri@sandia:~/Code/cve-bin-tool$ cve-bin-tool -v /usr/bin/openssl
178+
/usr/bin/openssl contains openssl 1.0.2g
179+
Known CVEs in version 1.0.2g
180+
CVE-2017-3731 CVE-2017-3732 CVE-2016-7055 CVE-2016-7052 CVE-2016-6304 CVE-2016-2183 CVE-2016-6303 CVE-2016-6302 CVE-2016-2182 CVE-2016-2180 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-6306 CVE-2016-2107 CVE-2016-2105 CVE-2016-2106 CVE-2016-2109 CVE-2016-2176
181+
CVE-2016-2105 (7.5-H)
182+
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
183+
CVE-2016-2106 (7.5-H)
184+
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
185+
CVE-2016-2107 (5.9-M)
186+
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
187+
CVE-2016-2109 (7.5-H)
188+
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
189+
CVE-2016-2176 (8.2-H)
190+
The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
191+
CVE-2016-2177 (5.9-M)
192+
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
193+
CVE-2016-2178 (5.5-M)
194+
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
195+
CVE-2016-2179 (7.5-H)
196+
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.
197+
CVE-2016-2180 (7.5-H)
198+
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.
199+
CVE-2016-2181 (7.5-H)
200+
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.
201+
CVE-2016-2182 (9.8-C)
202+
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
203+
CVE-2016-2183 (5.3-M)
204+
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
205+
CVE-2016-6302 (7.5-H)
206+
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
207+
CVE-2016-6303 (9.8-C)
208+
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
209+
CVE-2016-6304 (7.5-H)
210+
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
211+
CVE-2016-6306 (5.9-M)
212+
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
213+
CVE-2016-7052 (7.5-H)
214+
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.
215+
CVE-2016-7055 (Error)
216+
217+
CVE-2017-3731 (Error)
218+
219+
CVE-2017-3732 (Error)
220+
221+
222+
Overall CVE summary:
223+
There are 1 files with known CVEs detected
224+
Known cves in ['openssl1.0.2g'] :
225+
['CVE-2016-2105', 'CVE-2016-2106', 'CVE-2016-2107', 'CVE-2016-2109', 'CVE-2016-2176', 'CVE-2016-2177', 'CVE-2016-2178', 'CVE-2016-2179', 'CVE-2016-2180', 'CVE-2016-2181', 'CVE-2016-2182', 'CVE-2016-2183', 'CVE-2016-6302', 'CVE-2016-6303', 'CVE-2016-6304', 'CVE-2016-6306', 'CVE-2016-7052', 'CVE-2016-7055', 'CVE-2017-3731', 'CVE-2017-3732']
226+
```
227+
228+
Note that the ones listed as "Error" are new items where the database has not yet been updated with vulnerability information. This information could easily be found by searching for the CVE numbers using a regular search engine or through a CVE website such as http://cvedetails.com
229+
230+
Also, please note that the severities shown are the ones from the public CVE
231+
databases. The actual severity for a given product may be different based on
232+
what parts of the library are used and what other mitigating factors may be in
233+
effect.
234+
235+
236+
### Quiet Mode
237+
238+
As the name implies, quiet mode has no console output, and one must check the
239+
return code to see if any issues were found.
240+
241+
Below is what it returns on bash when one file is found to have CVEs:
242+
```
243+
terri@sandia:~/Code/cve-bin-tool$ cve-bin-tool -q /usr/bin/openssl
244+
terri@sandia:~/Code/cve-bin-tool$ echo $?
245+
1
246+
```
247+
248+
Feedback & Contributions
249+
------------------------
250+
251+
Bugs and feature requests can be made via [GitHub
252+
issues](https://github.com/intel/cve-bin-tool). Be aware that these issues are
253+
not private, so take care when providing output to make sure you are not
254+
disclosing security issues in other products.
255+
256+
Pull requests are also welcome via git.
257+
258+
259+
Security Issues
260+
---------------
261+
262+
Security issues with the tool itself can be reported to Intel's security
263+
incident response team via
264+
[https://intel.com/security](https://intel.com/security).
265+
266+
If in the course of using this tool you discover a security issue with someone
267+
else's code, please disclose responsibly to the appropriate party.

Diff for: ‎README.md

+79
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
CVE checker for binary code
2+
===========================
3+
4+
This tool scans for a number of common, vulnerable open source components
5+
(openssl, libpng, libxml2, expat and a few others) to let you know if your
6+
system includes common libraries with known vulnerabilities.
7+
8+
Usage:
9+
`python -m cve_bin_tool.cli <flags> <path to directory>`
10+
11+
Possible output levels:
12+
-v (verbose): print scan results as they're found
13+
(regular): print only final summary
14+
-q (quiet): suppress all output but exit with error
15+
number indicating number of files with CVE
16+
17+
Other options:
18+
-x (extract): Autoextract compressed files
19+
20+
When running this script, Python 3 is preferred over Python 2.7 because it has
21+
been more tested, but both versions should work.
22+
23+
This readme is intended to be a quickstart guide for using the tool. If you
24+
require more information, there is also a [user manual](MANUAL.md) available.
25+
26+
How it works
27+
------------
28+
29+
This scanner looks at the strings found in binary files to see if they
30+
match certain vulnerable versions of the following libraries and tools:
31+
32+
* curl
33+
* expat
34+
* libnss
35+
* node.js
36+
* openssl
37+
* png
38+
* tiff
39+
* xerces
40+
* xml2
41+
* zlib
42+
43+
All the checkers can be found in the checkers directory, as can the
44+
[instructions on how to add a new checker](cve_bin_tool/checkers/README.md).
45+
Support for new checkers can be requested via
46+
[GitHub issues](https://github.com/intel/cve-bin-tool/issues).
47+
48+
Limitations
49+
-----------
50+
51+
This scanner does not attempt to exploit issues or examine the code in greater
52+
detail; it only looks for library signatures and version numbers. As such, it
53+
cannot tell if someone has backported fixes to a vulnerable version, and it
54+
will not work if library or version information was intentionally obfuscated.
55+
56+
This tool is meant to be used as a quick-to-run, easily-automatable check in a
57+
non-malicious environment so that developers can be made aware of old libraries
58+
with security issues that have been compiled into their binaries.
59+
60+
Feedback & Contributions
61+
------------------------
62+
63+
Bugs and feature requests can be made via [GitHub
64+
issues](https://github.com/intel/cve-bin-tool). Be aware that these issues are
65+
not private, so take care when providing output to make sure you are not
66+
disclosing security issues in other products.
67+
68+
Pull requests are also welcome via git.
69+
70+
Security Issues
71+
---------------
72+
73+
Security issues with the tool itself can be reported to Intel's security
74+
incident response team via
75+
[https://intel.com/security](https://intel.com/security).
76+
77+
If in the course of using this tool you discover a security issue with someone
78+
else's code, please disclose responsibly to the appropriate party.
79+

0 commit comments

Comments
 (0)