chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one
    byte too small for the maximal Quantum block, leading to an out-of-bounds write. (CVE-2018-18584)

  - chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its
    first or second character (such as the "/\0" name). (CVE-2018-18585)

  - chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not
    protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor
    disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code
    example, not a supported application (CVE-2018-18586)

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:4287-1 advisory.

    - CVE-2018-18586: Add leading slash protection to chmextract. (bsc#1113040)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:0069-2 advisory.

    - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash     protection (bsc#1113040).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:0069-1 advisory.

  - ** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before     0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory     Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only     intended as a source-code example, not a supported application. (CVE-2018-18586)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:0069-1 advisory.

    - CVE-2018-18586: Fixed directory traversal in chmextract by adding anti '../' and leading slash     protection (bsc#1113040).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - chmextract.c in the chmextract sample program, as     distributed with libmspack before 0.8alpha, does not     protect against absolute/relative pathnames in CHM     files, leading to Directory Traversal. NOTE: the vendor     disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** chmextract.c in the chmextract sample     program, as distributed with libmspack before 0.8alpha,     does not protect against absolute/relative pathnames in     CHM files, leading to Directory Traversal. NOTE: the     vendor disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

  - ** DISPUTED ** chmextract.c in the chmextract sample     program, as distributed with libmspack before 0.8alpha,     does not protect against absolute/relative pathnames in     CHM files, leading to Directory Traversal. NOTE: the     vendor disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

  - The cabd_read_string function in mspack/cabd.c in     libmspack 0.5alpha, as used in ClamAV 0.99.2 and other     products, allows remote attackers to cause a denial of     service (stack-based buffer over-read and application     crash) via a crafted CAB file.(CVE-2017-11423)

  - mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV     0.99.2, allows remote attackers to cause a denial of     service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted CHM file.(CVE-2017-6419)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-20 (cabextract, libmspack: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cabextract and       libmspack. Please review the CVE identifiers referenced below for       details.
  Impact :

    Please review the referenced CVE&rsquo;s for details.
  Workaround :

    There is no known workaround at this time.

This update for libmspack fixes the following issues :

Security issues fixed :

  - CVE-2018-18584: The CAB block input buffer was one byte     too small for the maximal Quantum block, leading to an     out-of-bounds write. (bsc#1113038)

  - CVE-2018-18585: chmd_read_headers accepted a filename     that has '\0' as its first or second character (such as     the '/\0' name). (bsc#1113039)

  - CVE-2018-18586: chmextract.c in the chmextract sample     program did not protect against absolute/relative     pathnames in CHM files, leading to Directory Traversal.
    NOTE: the vendor disputes that this is a libmspack     vulnerability, because chmextract.c was only intended as     a source-code example, not a supported application.
    (boo#1113040)

  - Fix off-by-one bounds check on CHM PMGI/PMGL chunk     numbers and reject empty filenames.

ID	Name	Product	Family	Severity
405234	Alpine: multiple libmspack packages: security update to 0.8_alpha-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
405234	Alpine: multiple libmspack packages: security update to 0.8_alpha-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
400612	Alpine: multiple libmspack packages: security update to 0.7.1-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
400612	Alpine: multiple libmspack packages: security update to 0.7.1-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
168302	SUSE SLES12 Security Update : libmspack (SUSE-SU-2022:4287-1)	Nessus	SuSE Local Security Checks	medium
158174	SUSE SLES15 Security Update : libmspack (SUSE-SU-2022:0069-2)	Nessus	SuSE Local Security Checks	medium
156747	openSUSE 15 Security Update : libmspack (openSUSE-SU-2022:0069-1)	Nessus	SuSE Local Security Checks	medium
156746	SUSE SLED15 / SLES15 Security Update : libmspack (SUSE-SU-2022:0069-1)	Nessus	SuSE Local Security Checks	medium
153358	EulerOS 2.0 SP2 : libmspack (EulerOS-SA-2021-2398)	Nessus	Huawei Local Security Checks	medium
135532	EulerOS 2.0 SP3 : libmspack (EulerOS-SA-2020-1403)	Nessus	Huawei Local Security Checks	medium
132607	EulerOS 2.0 SP8 : libmspack (EulerOS-SA-2020-1014)	Nessus	Huawei Local Security Checks	medium
131808	EulerOS 2.0 SP5 : libmspack (EulerOS-SA-2019-2534)	Nessus	Huawei Local Security Checks	high
123426	GLSA-201903-20 : cabextract, libmspack: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
118561	openSUSE Security Update : libmspack (openSUSE-2018-1329)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2018-18586

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

medium