CVE-2017-1000458: Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote atta

This week

CRITICAL 9.8REMOTEDOWNGRADE

CVE-2017-1000458 is a critical-severity flaw (CVSS 9.8) affecting bro. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.

Why this priority

Critical severity
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	2.3% (top 17%)
CISA exploited list	No
Weakness	CWE-787
Published	2018-01-02
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: bro

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2018-01-02 18:29 UTCPublished CVE record published
2026-06-17 00:59 UTCUpdated Record last modified

bro bro DOWNGRADE

Affected: 2.5.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 2.5.2

1. Check installed version

apt-cache policy bro || rpm -q bro || bro --version

2. No fixed release: DOWNGRADE to a release before 2.5.2 (Debian / Ubuntu)

apt-cache madison bro sudo apt install bro=<VERSION_BEFORE_2.5.2> sudo apt-mark hold bro

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list bro sudo dnf downgrade bro-<VERSION_BEFORE_2.5.2> sudo dnf versionlock add bro

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-1000458?

bro: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-1000458 being exploited?

CVE-2017-1000458 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-1000458 affect?

CVE-2017-1000458 affects bro. Severity is critical (CVSS 9.8). Bro before Bro v2.5.2 is vulnerable to an out of bounds write in the ContentLine analyzer allowing remote attackers to cause a denial of service (crash) and possibly other exploitation.

How urgent is CVE-2017-1000458?

Priority 60/100. Critical severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2018-17019 HIGH 7.5 UPGRADE In Bro through 2.5.5, there is a DoS in IRC protocol names command parsing in analyzer/protocol/irc/IRC.cc.
CVE-2018-16807 HIGH 7.5 UPGRADE In Bro through 2.5.5, there is a memory leak potentially leading to DoS in scripts/base/protocols/krb/main.bro
CVE-2015-1522 HIGH 7.5 UPGRADE analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length,
CVE-2015-1521 HIGH 7.5 UPGRADE analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, wh

References

← Back to latest CVEs