Bugzilla – Bug 934524
VUL-1: CVE-2014-9732: cabextract,libmspack: null pointer dereference on a crafted CAB
Last modified: 2017-03-06 12:23:48 UTC
rh#1196146 The cabd_extract function in cabd.c in libmspack before 0.5 does not properly maintain decompression callbacks in certain cases where an invalid file follows a valid file, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted CAB archive. References: https://bugzilla.redhat.com/show_bug.cgi?id=1196146 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9732 http://seclists.org/oss-sec/2015/q2/691 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774726#3 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774665 http://anonscm.debian.org/cgit/collab-maint/libmspack.git/commit/?id=a25bb144795e526748b57884daf365732c7e2295 http://openwall.com/lists/oss-security/2015/02/03/11 For SLE 11, this needs to be fixed libmspack and cabextract. For SLE 12, cabextract builds --with-external-libmspack, so only libmspack needs to be fixed.
An update workflow for this issue was started. This issue was rated as low. Please submit fixed packages until 2015-07-10. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/61986
bugbot adjusting priority
http://anonscm.debian.org/cgit/collab-maint/libmspack.git/commit/?id=a25bb144795e526748b57884daf365732c7e2295 seems to be incorrect, as it covers different vulnerabilities: - fix-division-by-zero.patch (bsc#934525, CVE-2015-4467) - fix-pointer-arithmetic-overflow.patch (bsc#934526, CVE-2015-4468) - fix-name-field-boundaries.patch (bsc#934526, CVE-2015-4469) (Closes: Debian#774725, Debian#774726)
I found no relevant reference to the fix of this bug, but guessing from the description, this could be a fix: https://github.com/kyz/libmspack/commit/4f3e63aeb09da248c83d6a4c11d33b934525b941
SUSE patch name will be: libmspack-cabd_extract-null-deref.patch
SLE12: https://build.suse.de/request/show/60400 https://build.suse.de/package/show/home:sbrabec:branches:libmspack-security/libmspack.SUSE_SLE-12_Update SLE11 and openSUSE will be prepared tomorrow.
The patch was relatively easy to backport fo SLE11 libmspack, and I hope it is correct: https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11
Done. https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11 libmspack: https://build.suse.de/request/show/60558 cabextract: https://build.suse.de/request/show/60560
SUSE-SU-2015:2131-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 934524,934527,934528 CVE References: CVE-2014-9556,CVE-2014-9732,CVE-2015-4470,CVE-2015-4471 Sources used: SUSE Linux Enterprise Desktop 11-SP4 (src): cabextract-1.2-2.12.1 SUSE Linux Enterprise Desktop 11-SP3 (src): cabextract-1.2-2.12.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): cabextract-1.2-2.12.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): cabextract-1.2-2.12.1
SUSE-SU-2015:2215-1: An update that fixes 6 vulnerabilities is now available. Category: security (moderate) Bug References: 934524,934525,934526,934527,934528,934529 CVE References: CVE-2014-9732,CVE-2015-4467,CVE-2015-4469,CVE-2015-4470,CVE-2015-4471,CVE-2015-4472 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Server for VMWare 11-SP3 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Server 11-SP4 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Server 11-SP3 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Desktop 11-SP4 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Desktop 11-SP3 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): libmspack-0.0.20060920alpha-74.10.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): libmspack-0.0.20060920alpha-74.10.1
It seems to be fixed long time ago. All SLE versions are fixed. All openSUSE versions contain versions newer than libmspack-0.4-3.