You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -102,24 +127,37 @@ even though it may now be safely mitigated and the result a false positive.
102
127
Limitations
103
128
-----------
104
129
105
-
When running this script, Python 3 is preferred over Python 2.7. This tool
106
-
was developed for Linux and expects a number of common Linux utilities. It
107
-
can be run on Windows using cygwin or other option to ensure these utilities
108
-
are installed.
130
+
When running this script, Python 3 is preferred over Python 2.7, as python 2.7 support will be ending soon. Linux and Windows are supported, as is usage within cygwin on windows.
109
131
110
132
This tool does not scan for all possible known public vulnerabilities, it only
111
133
scans for specific commonly vulnerable open source components. A complete
112
134
list of currently supported library checkers can be found in [the checkers
As the name implies, this tool is intended for use with binaries. If you have
116
-
access to a known list of package names and versions, you may wish to use
117
-
another tool such as the [CVE check tool
118
-
here](https://github.com/ikeydoherty/cve-check-tool) which covers a larger
119
-
database of known public issues.
138
+
access to a known list of package names and versions, we do have a helper tool called [CSV2CVE](https://github.com/intel/cve-bin-tool/blob/master/CSV2CVE.md) that can be used to look up known vulnerabilities given a comma-delimited file. See the [documentation for CSV2CVE for more details](https://github.com/intel/cve-bin-tool/blob/master/CSV2CVE.md).
139
+
140
+
Options:
141
+
--------
142
+
143
+
### -x, --extract
144
+
145
+
This option allows the CVE Binary Tool to extract compressed files into a temporary directory so the contents can be scanned. If the quiet flag is not used, the list of extracted files will be printed.
146
+
147
+
### -s SKIPS, --skips SKIPS
148
+
149
+
This option allows one to skip (disable) a comma-separated list of checkers. This can be useful for improving the performance of the tool when you have some prior knowledge about what checkers may apply to the binary you are scanning.
150
+
151
+
### -m, --multithread enable multithread
152
+
153
+
This options allows one to enable multithread mode, so that the scanner can run in parallel on many files at once. This can be used to improve performance, particularly if you are scanning a large directory or a compressed file with many files in it.
This option controls the frequency of updates for the CVE data from the National Vulnerability Database. By default, the tool checks the staleness of the data with every run, and if the data is more than one day old, it gets an update from NVD. You may also choose to update the data `now` (in which case all cached data is deleted and a full new download is done) or `never` in which case the staleness check is not done and no update is requested. The `now` and `never` modes can be combined to produce alternative update schedules if daily is not the desired one.
158
+
159
+
Output modes
160
+
------------
123
161
124
162
The tool has several different output modes, from most information to least as follows:
125
163
@@ -129,122 +167,102 @@ The tool has several different output modes, from most information to least as f
129
167
130
168
Although the examples in this section show results for a single library to make them shorter and easier to read, the tool was designed to be run on entire directories and will scan all files in a directory if one is supplied.
131
169
132
-
### Default Mode
170
+
####Default Mode
133
171
134
172
The default mode for the cve-bin-tool prints only a final summary of results,
135
173
without CVE descriptions or information while the scan is progressing. It
136
174
outputs a CSV with the results to stdout. In the form of `package name, version,
137
-
CVE number, CVE severity`. Below is an example of it being run on curl:
175
+
CVE number, CVE severity`. Below is an example of it being run on our expat test file:
Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of binary data.
183
-
CVE-2016-2106 (7.5-H)
184
-
Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption) via a large amount of data.
185
-
CVE-2016-2107 (5.9-M)
186
-
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session, NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-0169.
187
-
CVE-2016-2109 (7.5-H)
188
-
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.
189
-
CVE-2016-2176 (8.2-H)
190
-
The X509_NAME_oneline function in crypto/x509/x509_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain sensitive information from process stack memory or cause a denial of service (buffer over-read) via crafted EBCDIC ASN.1 data.
191
-
CVE-2016-2177 (5.9-M)
192
-
OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.
193
-
CVE-2016-2178 (5.5-M)
194
-
The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.
195
-
CVE-2016-2179 (7.5-H)
196
-
The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which allows remote attackers to cause a denial of service (memory consumption) by maintaining many crafted DTLS sessions simultaneously, related to d1_lib.c, statem_dtls.c, statem_lib.c, and statem_srvr.c.
197
-
CVE-2016-2180 (7.5-H)
198
-
The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted time-stamp file that is mishandled by the "openssl ts" command.
199
-
CVE-2016-2181 (7.5-H)
200
-
The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.
201
-
CVE-2016-2182 (9.8-C)
202
-
The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
203
-
CVE-2016-2183 (5.3-M)
204
-
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
205
-
CVE-2016-6302 (7.5-H)
206
-
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
207
-
CVE-2016-6303 (9.8-C)
208
-
Integer overflow in the MDC2_Update function in crypto/mdc2/mdc2dgst.c in OpenSSL before 1.1.0 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors.
209
-
CVE-2016-6304 (7.5-H)
210
-
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
211
-
CVE-2016-6306 (5.9-M)
212
-
The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via crafted certificate operations, related to s3_clnt.c and s3_srvr.c.
213
-
CVE-2016-7052 (7.5-H)
214
-
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a CRL operation.
Known CVEs in sqlite 3.1.2, sqlite 3.UNKNOWN, curl 7.32.0:
245
+
sqlite,3.1.2,CVE-2018-20346,HIGH
246
+
sqlite,3.1.2,CVE-2018-20506,HIGH
247
+
... (Curl results omitted to save space)
226
248
```
227
249
228
-
Note that the ones listed as "Error" are new items where the database has not yet been updated with vulnerability information. This information could easily be found by searching for the CVE numbers using a regular search engine or through a CVE website such as http://cvedetails.com
229
-
230
-
Also, please note that the severities shown are the ones from the public CVE
231
-
databases. The actual severity for a given product may be different based on
232
-
what parts of the library are used and what other mitigating factors may be in
233
-
effect.
234
-
235
-
236
250
### Quiet Mode
237
251
238
252
As the name implies, quiet mode has no console output, and one must check the
239
-
return code to see if any issues were found.
253
+
return code to see if any issues were found. The return value will be the number of files that have been found to have CVEs
240
254
241
255
Below is what it returns on bash when one file is found to have CVEs:
0 commit comments