plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1837 advisory.

    The Plexus project provides a full software stack for creating and executing software projects. Based on     the Plexus container, the applications can utilise component-oriented programming to build modular,     reusable components that can easily be assembled and reused. The plexus-archiver component provides     functions to create and extract archives.

    Security Fix(es):

    * plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted     zip file (CVE-2018-1002200)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Danny Grander (Snyk) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-4832-1 advisory.

    It was discovered that Plexus Archiver incorrectly handled directory traversal during extraction. An     attacker could possibly use this for a Zip-Slip attack.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has plexus-archiver packages installed that are affected by a vulnerability:

  - A path traversal vulnerability has been discovered in     plexus-archiver when extracting a carefully crafted zip     file which holds path traversal file names. A remote     attacker could use this vulnerability to write files     outside the target directory and overwrite existing     files with malicious code or vulnerable configurations.
    (CVE-2018-1002200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file (CVE-2018-1002200)

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations.

Red Hat would like to thank Danny Grander (Snyk) for reporting this issue. External References:
https://snyk.io/research/zip-slip-vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names. A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations.(CVE-2018-1002200)

An update for plexus-archiver is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Plexus project provides a full software stack for creating and executing software projects. Based on the Plexus container, the applications can utilise component-oriented programming to build modular, reusable components that can easily be assembled and reused.
The plexus-archiver component provides functions to create and extract archives.

Security Fix(es) :

* plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file (CVE-2018-1002200)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Danny Grander (Snyk) for reporting this issue.

Security Fix(es) :

  - plexus-archiver: arbitrary file write vulnerability /     arbitrary code execution using a specially crafted zip     file (CVE-2018-1002200)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1836 advisory.

  - plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted     zip file (CVE-2018-1002200)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1836 advisory.

    [0:2.4.2-5]
    - Fix arbitrary file write vulnerability
    - Resolves: CVE-2018-1002200

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Danny Grander discovered a directory traversal flaw in plexus-archiver, an Archiver plugin for the Plexus compiler system, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted Zip archive.

ID	Name	Product	Family	Severity
194078	RHEL 6 / 7 : rh-maven33-plexus-archiver and rh-maven35-plexus-archiver (RHSA-2018:1837)	Nessus	Red Hat Local Security Checks	medium
183109	Ubuntu 18.04 ESM : Plexus Archiver vulnerability (USN-4832-1)	Nessus	Ubuntu Local Security Checks	medium
127216	NewStart CGSL CORE 5.04 / MAIN 5.04 : plexus-archiver Vulnerability (NS-SA-2019-0041)	Nessus	NewStart CGSL Local Security Checks	medium
120553	Fedora 28 : plexus-archiver (2018-7a9a2f6ec0)	Nessus	Fedora Local Security Checks	medium
110782	Amazon Linux 2 : plexus-archiver (ALAS-2018-1043)	Nessus	Amazon Linux Local Security Checks	medium
110538	Fedora 27 : plexus-archiver (2018-6c55e1f79c)	Nessus	Fedora Local Security Checks	medium
110536	CentOS 7 : plexus-archiver (CESA-2018:1836)	Nessus	CentOS Local Security Checks	medium
110508	Scientific Linux Security Update : plexus-archiver on SL7.x (noarch) (20180612)	Nessus	Scientific Linux Local Security Checks	medium
110507	RHEL 7 : plexus-archiver (RHSA-2018:1836)	Nessus	Red Hat Local Security Checks	medium
110505	Oracle Linux 7 : plexus-archiver (ELSA-2018-1836)	Nessus	Oracle Linux Local Security Checks	medium
110503	Debian DSA-4227-1 : plexus-archiver - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-1002200

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium