chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\0' as its first or second character (such as the "/\0" name).

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2049 advisory.

    [0.5-0.7.alpha]
    - Fixes for CVE-2018-18584 CVE-2018-18585.
      resolves: rhbz#1648384 rhbz#1648385

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libmspack fixes the following issues :

Security issues fixed :

CVE-2019-1010305: Fixed a buffer overflow triggered by a crafted chm file which could have led to information disclosure (bsc#1141680).

CVE-2018-18584: The CAB block input buffer was one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
(bsc#1113038)

CVE-2018-18585: chmd_read_headers accepted a filename that has '\0' as its first or second character (such as the '/\0' name). (bsc#1113039)

Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and reject empty filenames.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libmspack packages installed that are affected by multiple vulnerabilities:

  - In mspack/cab.h in libmspack before 0.8alpha and     cabextract before 1.8, the CAB block input buffer is one     byte too small for the maximal Quantum block, leading to     an out-of-bounds write. (CVE-2018-18584)

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the /\0 name).
    (CVE-2018-18585)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

  - mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV     0.99.2, allows remote attackers to cause a denial of     service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted CHM file.(CVE-2017-6419)

  - The cabd_read_string function in mspack/cabd.c in     libmspack 0.5alpha, as used in ClamAV 0.99.2 and other     products, allows remote attackers to cause a denial of     service (stack-based buffer over-read and application     crash) via a crafted CAB file.(CVE-2017-11423)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

  - ** DISPUTED ** chmextract.c in the chmextract sample     program, as distributed with libmspack before 0.8alpha,     does not protect against absolute/relative pathnames in     CHM files, leading to Directory Traversal. NOTE: the     vendor disputes that this is a libmspack vulnerability,     because chmextract.c was only intended as a source-code     example, not a supported application.(CVE-2018-18586)

  - The cabd_read_string function in mspack/cabd.c in     libmspack 0.5alpha, as used in ClamAV 0.99.2 and other     products, allows remote attackers to cause a denial of     service (stack-based buffer over-read and application     crash) via a crafted CAB file.(CVE-2017-11423)

  - mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV     0.99.2, allows remote attackers to cause a denial of     service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted CHM file.(CVE-2017-6419)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

  - The cabd_read_string function in mspack/cabd.c in     libmspack 0.5alpha, as used in ClamAV 0.99.2 and other     products, allows remote attackers to cause a denial of     service (stack-based buffer over-read and application     crash) via a crafted CAB file.(CVE-2017-11423)

  - mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV     0.99.2, allows remote attackers to cause a denial of     service (heap-based buffer overflow and application     crash) or possibly have unspecified other impact via a     crafted CHM file.(CVE-2017-6419)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libmspack packages installed that are affected by multiple vulnerabilities:

  - An issue was discovered in mspack/chmd.c in libmspack     before 0.7alpha. There is an off-by-one error in the CHM     PMGI/PMGL chunk number validity checks, which could lead     to denial of service (uninitialized data dereference and     application crash). (CVE-2018-14679)

  - In mspack/cab.h in libmspack before 0.8alpha and     cabextract before 1.8, the CAB block input buffer is one     byte too small for the maximal Quantum block, leading to     an out-of-bounds write. (CVE-2018-18584)

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the /\0 name).
    (CVE-2018-18585)

  - An issue was discovered in mspack/chmd.c in libmspack     before 0.7alpha. It does not reject blank CHM filenames.
    (CVE-2018-14680)

  - An issue was discovered in mspack/chmd.c in libmspack     before 0.7alpha. There is an off-by-one error in the     TOLOWER() macro for CHM decompression. (CVE-2018-14682)

  - An issue was discovered in kwajd_read_headers in     mspack/kwajd.c in libmspack before 0.7alpha. Bad KWAJ     file header extensions could cause a one or two byte     overwrite. (CVE-2018-14681)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the libmspack package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - chmd_read_headers in mspack/chmd.c in libmspack before     0.8alpha accepts a filename that has '\0' as its first     or second character (such as the '/\0'     name).(CVE-2018-18585)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In mspack/cab.h in libmspack before 0.8alpha and cabextract before 1.8, the CAB block input buffer is one byte too small for the maximal Quantum block, leading to an out-of-bounds write.(CVE-2018-18584)

chmd_read_headers in mspack/chmd.c in libmspack before 0.8alpha accepts a filename that has '\\0' as its first or second character (such as the '/\\0' name).(CVE-2018-18585)

An update for libmspack is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The libmspack packages contain a library providing compression and extraction of the Cabinet (CAB) file format used by Microsoft.

Security Fix(es) :

* libmspack: Out-of-bounds write in mspack/cab.h (CVE-2018-18584)

* libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes (CVE-2018-18585)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - libmspack: Out-of-bounds write in mspack/cab.h     (CVE-2018-18584)

  - libmspack: chmd_read_headers() fails to reject filenames     containing NULL bytes (CVE-2018-18585)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2049 advisory.

    The libmspack packages contain a library providing compression and extraction of the Cabinet (CAB) file     format used by Microsoft.

    Security Fix(es):

    * libmspack: Out-of-bounds write in mspack/cab.h (CVE-2018-18584)

    * libmspack: chmd_read_headers() fails to reject filenames containing NULL bytes (CVE-2018-18585)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libmspack fixes the following issues :

Security issues fixed :

  - CVE-2018-18584: The CAB block input buffer was one byte     too small for the maximal Quantum block, leading to an     out-of-bounds write. (bsc#1113038)

  - CVE-2018-18585: chmd_read_headers accepted a filename     that has '\0' as its first or second character (such as     the '/\0' name). (bsc#1113039)

  - Fix off-by-one bounds check on CHM PMGI/PMGL chunk     numbers and reject empty filenames.

This update was imported from the SUSE:SLE-15:Update update project.

This update for libmspack fixes the following issues :

Security issues fixed :

CVE-2018-18584: The CAB block input buffer was one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
(bsc#1113038)

CVE-2018-18585: chmd_read_headers accepted a filename that has '\0' as its first or second character (such as the '/\0' name). (bsc#1113039)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-20 (cabextract, libmspack: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cabextract and       libmspack. Please review the CVE identifiers referenced below for       details.
  Impact :

    Please review the referenced CVE&rsquo;s for details.
  Workaround :

    There is no known workaround at this time.

This update for libmspack fixes the following issues :

Security issues fixed :

CVE-2018-18584: The CAB block input buffer was one byte too small for the maximal Quantum block, leading to an out-of-bounds write.
(bsc#1113038)

CVE-2018-18585: chmd_read_headers accepted a filename that has '\0' as its first or second character (such as the '/\0' name). (bsc#1113039)

Fix off-by-one bounds check on CHM PMGI/PMGL chunk numbers and reject empty filenames.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Latest stable releases of libmspack and cabextract, includes security fixes for CVE-2018-14680, CVE-2018-14681, CVE-2018-14682, CVE-2018-18584, CVE-2018-18585

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3814-2 advisory.

    Updated: 2018-11-21: The embedded version of libmspack in ClamAV was found to not be affected by the     listed vulnerabilities, therefore the following is not applicable.

    USN-3814-1 fixed several vulnerabilities in libmspack. In Ubuntu 14.04 libmspack is included into ClamAV.
    This update provides the corresponding update for Ubuntu 14.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3814-1 advisory.

    It was discovered libmspack incorrectly handled certain malformed CAB files. A remote attacker could use     this issue to cause libmspack to crash, resulting in a denial of service. (CVE-2018-18584, CVE-2018-18585)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libmspack fixes the following issues :

Security issues fixed :

  - CVE-2018-18584: The CAB block input buffer was one byte     too small for the maximal Quantum block, leading to an     out-of-bounds write. (bsc#1113038)

  - CVE-2018-18585: chmd_read_headers accepted a filename     that has '\0' as its first or second character (such as     the '/\0' name). (bsc#1113039)

  - CVE-2018-18586: chmextract.c in the chmextract sample     program did not protect against absolute/relative     pathnames in CHM files, leading to Directory Traversal.
    NOTE: the vendor disputes that this is a libmspack     vulnerability, because chmextract.c was only intended as     a source-code example, not a supported application.
    (boo#1113040)

  - Fix off-by-one bounds check on CHM PMGI/PMGL chunk     numbers and reject empty filenames.

CVE-2018-18584 Fixing the size of the CAB block input buffer, which is too small for the maximal Quantum block, prevents an out-of-bounds write.

CVE-2018-18585 Blank filenames (having length zero or their 1st or 2nd byte is null) should be rejected.

For Debian 8 'Jessie', these problems have been fixed in version 0.5-1+deb8u3.

We recommend that you upgrade your libmspack packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180768	Oracle Linux 7 : libmspack (ELSA-2019-2049)	Nessus	Oracle Linux Local Security Checks	medium
164608	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.11.2)	Nessus	Misc.	critical
164581	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.10.9)	Nessus	Misc.	critical
164573	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.16)	Nessus	Misc.	critical
143825	SUSE SLES12 Security Update : libmspack (SUSE-SU-2020:2711-1)	Nessus	SuSE Local Security Checks	medium
132502	NewStart CGSL CORE 5.05 / MAIN 5.05 : libmspack Multiple Vulnerabilities (NS-SA-2019-0237)	Nessus	NewStart CGSL Local Security Checks	medium
132144	EulerOS 2.0 SP3 : libmspack (EulerOS-SA-2019-2609)	Nessus	Huawei Local Security Checks	high
131808	EulerOS 2.0 SP5 : libmspack (EulerOS-SA-2019-2534)	Nessus	Huawei Local Security Checks	high
131608	EulerOS 2.0 SP2 : libmspack (EulerOS-SA-2019-2454)	Nessus	Huawei Local Security Checks	high
131413	NewStart CGSL CORE 5.04 / MAIN 5.04 : libmspack Multiple Vulnerabilities (NS-SA-2019-0217)	Nessus	NewStart CGSL Local Security Checks	high
131351	EulerOS 2.0 SP8 : libmspack (EulerOS-SA-2019-2285)	Nessus	Huawei Local Security Checks	medium
129792	Amazon Linux 2 : libmspack (ALAS-2019-1310)	Nessus	Amazon Linux Local Security Checks	medium
128340	CentOS 7 : libmspack (CESA-2019:2049)	Nessus	CentOS Local Security Checks	medium
128232	Scientific Linux Security Update : libmspack on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	medium
127659	RHEL 7 : libmspack (RHSA-2019:2049)	Nessus	Red Hat Local Security Checks	medium
123778	openSUSE Security Update : libmspack (openSUSE-2019-1149)	Nessus	SuSE Local Security Checks	medium
123455	SUSE SLES11 Security Update : libmspack (SUSE-SU-2019:13992-1)	Nessus	SuSE Local Security Checks	medium
123426	GLSA-201903-20 : cabextract, libmspack: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
123412	SUSE SLED15 / SLES15 Security Update : libmspack (SUSE-SU-2019:0748-1)	Nessus	SuSE Local Security Checks	medium
120791	Fedora 28 : cabextract / libmspack (2018-cb337fb199)	Nessus	Fedora Local Security Checks	high
120675	Fedora 29 : cabextract / libmspack (2018-a5953af115)	Nessus	Fedora Local Security Checks	high
119019	Fedora 27 : cabextract / libmspack (2018-c73d257297)	Nessus	Fedora Local Security Checks	high
118905	Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-3814-2)	Nessus	Ubuntu Local Security Checks	medium
118904	Ubuntu 16.04 LTS / 18.04 LTS : libmspack vulnerabilities (USN-3814-1)	Nessus	Ubuntu Local Security Checks	medium
118561	openSUSE Security Update : libmspack (openSUSE-2018-1329)	Nessus	SuSE Local Security Checks	medium
118468	Debian DLA-1555-1 : libmspack security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2018-18585

medium

Tenable Plugins

medium

critical

critical

critical

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

high

medium

high

high

high

medium

medium

medium

medium