cabextract before 1.6 does not properly check for leading slashes when extracting files, which allows remote attackers to conduct absolute directory traversal attacks via a malformed UTF-8 character that is changed to a UTF-8 encoded slash.

Cabextract ChangeLog reports :

It was possible for cabinet files to extract to absolute file locations, and it was possible on Cygwin to get around cabextract's absolute and relative path protections by using backslashes.

Updated cabextract packages fix security vulnerabilities :

Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556).

A directory traversal issue in cabextract allows writing to locations outside of the current working directory, when extracting a crafted cab file that encodes the filenames in a certain manner (CVE-2015-2060).

Security fix for directory traversal with UTF-8 symbols in filenames.
Fixed in upstream version 1.5.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
83943	FreeBSD : cabextract -- directory traversal with UTF-8 symbols in filenames (cfb12f02-06e1-11e5-8fda-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
82317	Mandriva Linux Security Advisory : cabextract (MDVSA-2015:064)	Nessus	Mandriva Local Security Checks	medium
81709	Fedora 21 : cabextract-1.5-1.fc21 (2015-2746)	Nessus	Fedora Local Security Checks	low
81707	Fedora 20 : cabextract-1.5-1.fc20 (2015-2730)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2015-2060

medium

Tenable Plugins

medium

medium

low

low