Denial of Service Vulnerability in Sleuth Kit by Open Source Digital Forensics Tool

CVE-2018-19497

What is CVE-2018-19497?

A vulnerability in The Sleuth Kit (TSK) through version 4.6.4 could allow an attacker to exploit a flaw in the hfs_cat_traverse function. This issue arises from the inability of the software to properly determine when a key length exceeds acceptable limits. Consequently, this oversight could lead to a denial of service scenario, specifically causing a segmentation fault (SEGV) which could manifest as a memory access violation in the tsk_getu16 function call within hfs_dir_open_meta_cb. This highlights the importance of ensuring proper input validation to mitigate potential risks.

References