Bug 915181 (CVE-2015-1386) - VUL-1: CVE-2015-1386 unshield: directory traversal
Summary: VUL-1: CVE-2015-1386 unshield: directory traversal
Status: RESOLVED WONTFIX
Alias: CVE-2015-1386
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P4 - Low : Minor
Target Milestone: ---
Assignee: Martin Pluskal
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/113248/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-28 14:15 UTC by Victor Pereira
Modified: 2019-05-29 08:56 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2015-01-28 14:15:21 UTC 
rh#1185717

Jakub Wilk reports:

Package: unshield
Version: 1.0-1
Tags: security

unshield is vulnerable to directory traversal via "../" sequences. As a 
proof of concept, unpacking the attached InstallShield archive creates a 
file in /tmp:

$ ls /tmp/moo
ls: cannot access /tmp/moo: No such file or directory

$ unshield x data1.cab
Cabinet: data1.cab
 extracting: ./Bovine_Files/../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/moo
--------  -------
         1 files

$ ls /tmp/moo
/tmp/moo



References:
https://bugzilla.redhat.com/show_bug.cgi?id=1185717
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1386
Comment 1 Swamp Workflow Management 2015-01-28 23:00:14 UTC 
bugbot adjusting priority
Comment 2 Philipp Thomas 2015-03-11 12:58:33 UTC 
No other distribution has a patch AFAICS and I'm unable to locate the place where directory names are read and stored.
Comment 3 Philipp Thomas 2017-05-10 06:58:00 UTC 
Closing because 13.2 isn't supported anymore.
Comment 4 Martin Pluskal 2017-05-11 09:02:12 UTC 
It seems that version 1.4.0 includes fix for this issue
Comment 5 Martin Pluskal 2017-05-11 09:07:50 UTC 
According to upstream changelog only changes are security and build fixes:
- Update to version 1.4.2:
  * exit run-tests.sh with non-zero if there were failed tests
- Changes for 1.4.1:
  * Security and distro fixes
- Changes for 1.4.0:
  * Including fix for CVE-2015-1386 (boo#915181)

However there is change of soversion of library - I am not sure if this would be ok to submit as maint update.
Comment 6 Martin Pluskal 2019-05-29 08:56:19 UTC 
Does not seem to be of relevance anymore