Pacman up to 5.1.2 Remote Package Installation lib/libalpm/dload.c Content-Disposition Header path traversal

Summaryinfo

A vulnerability was found in Pacman up to 5.1.2. It has been classified as critical. Affected by this vulnerability is an unknown functionality in the library lib/libalpm/dload.c of the component Remote Package Installation. The manipulation as part of Content-Disposition Header leads to path traversal. This vulnerability is traded as CVE-2019-9686. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Pacman up to 5.1.2 and classified as critical. This issue affects an unknown code block in the library lib/libalpm/dload.c of the component Remote Package Installation. The manipulation as part of a Content-Disposition Header leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

pacman before 5.1.3 allows directory traversal when installing a remote package via a specified URL "pacman -U <url>" due to an unsanitized file name received from a Content-Disposition header. pacman renames the downloaded package file to match the name given in this header. However, pacman did not sanitize this name, which may contain slashes, before calling rename(). A malicious server (or a network MitM if downloading over HTTP) can send a Content-Disposition header to make pacman place the file anywhere in the filesystem, potentially leading to arbitrary root code execution. Notably, this bypasses pacman's package signature checking. This occurs in curl_download_internal in lib/libalpm/dload.c.

The bug was discovered 03/01/2019. The weakness was shared 03/11/2019. The identification of this vulnerability is CVE-2019-9686 since 03/11/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 10 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 5.1.3 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Pacman

Version

• 5.1.0
• 5.1.1
• 5.1.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion