title: Velociraptor crashes while parsing some malformed PE or OLE files.
description: Due to insufficient validation in the PE and OLE parsers in Rapid7's Velociraptor versions earlier than 0.6.8 allows attacker to crash Velociraptor during parsing of maliciously malformed files.
For this attack to succeed, the attacker needs to be able to introduce malicious files to the system at the same time that Velociraptor attempts to collect any artifacts that attempt to parse PE files, Authenticode signatures, or OLE files. After crashing, the Velociraptor service will restart and it will still be possible to collect other artifacts.
problem types: CWE-125 Out-of-bounds Read
affected:
{
collectionURL: https://github.com/Velocidex/velociraptor/releases
defaultStatus: unaffected
modules: [PE Parser, OLE parser, Authenticode parser]
packageName: Velociraptor
platforms: Windows
product: Velociraptor
repo: https://github.com/Velocidex/velociraptor/
vendor: Rapid7
versions:
lessThan: 0.6.8, status: affected, version: 0, versionType: semver
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Upgrade the clients to version 0.6.8-2