A vulnerability was found in libmspack up to 0.7 and classified as critical. Affected by this issue is some unknown processing of the file chmextract.c of the component chmextract Sample Program. The manipulation as part of a CHM File leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

** DISPUTED ** chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application.

The bug was discovered 10/23/2018. The weakness was disclosed 10/23/2018 (Website). The advisory is shared for download at bugs.debian.org. This vulnerability is handled as CVE-2018-18586 since 10/22/2018. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

The real existence of this vulnerability is still doubted at the moment. The vulnerability scanner Nessus provides a plugin with the ID 118561 (openSUSE Security Update : libmspack (openSUSE-2018-1329)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family SuSE Local Security Checks and running in the context l.

Upgrading to version 0.8alpha eliminates this vulnerability. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (118561). The entries 125850 and 125851 are pretty similar.

Productinfo

Name

• libmspack

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion