| Summary: | gcab new security issue CVE-2018-5345 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | marja11, oe, sysadmin-bugs, tarazed25 |
| Version: | 6 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA5TOO MGA5-64-OK MGA6-64-OK | ||
| Source RPM: | gcab-0.7-1.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2018-01-26 04:58:11 CET
David Walser
2018-01-26 04:58:19 CET
Whiteboard:
(none) =>
MGA6TOO Assigning to all packagers collectively, since the registered maintainer for this package seems unavailable. @ Oden Please reassign to yourself if I'm wrong about that! CC:
(none) =>
marja11, oe The issue was also fixed in the 0.8 release. Cauldron is not affected. Version:
Cauldron =>
6 Patched packages uploaded for Mageia 5 and Mageia 6. Advisory: ======================== Updated gcab packages fix security vulnerabilities: It was discovered that gcab is prone to a stack-based buffer overflow vulnerability when extracting .cab files. An attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running gcab, if a specially crafted .cab file is processed (CVE-2018-5345). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5345 https://www.debian.org/security/2018/dsa-4095 ======================== Updated packages in core/updates_testing: ======================== gcab-0.4-6.1.mga5 libgcab1.0_0-0.4-6.1.mga5 libgcab-gir1.0-0.4-6.1.mga5 libgcab-devel-0.4-6.1.mga5 gcab-0.7-1.1.mga6 libgcab1.0_0-0.7-1.1.mga6 libgcab-gir1.0-0.7-1.1.mga6 libgcab-devel-0.7-1.1.mga6 from SRPMS: gcab-0.4-6.1.mga5.src.rpm gcab-0.7-1.1.mga6.src.rpm Assignee:
pkg-bugs =>
qa-bugs Testing M5/64
There is no PoC.
BEFORE upodate, installed:
gcab-0.4-6.mga5
lib64gcab1.0_0-0.4-6.mga5
lib64gcab-gir1.0-0.4-6.mga5
and the following commands from a randomly populated directory showed use of lib64gcab1.0_0 only for all main operations:
1. Create a CAB file:
$ strace gcab -cv cabfile.cab * 2>&1 | grep libgcab
open("/lib64/libgcab-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3
2. List it:
$ strace gcab -tv cabfile.cab 2>&1 | grep libgcab
open("/lib64/libgcab-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3
3. Extract it to a lower-level directory:
$ mkdir tmp
$ strace gcab -xv -C tmp cabfile.cab 2>&1 | grep libgcab
open("/lib64/libgcab-1.0.so.0", O_RDONLY|O_CLOEXEC) = 3
whose contents were the same as the original.
AFTER update:
- gcab-0.4-6.1.mga5.x86_64
- lib64gcab-gir1.0-0.4-6.1.mga5.x86_64
- lib64gcab1.0_0-0.4-6.1.mga5.x86_64
1. Create a CAB file:
$ gcab -cv cabfile.cab *
...
List of files as archived.
2. List the archive :
$ gcab -tv cabfile.cab
...
The same file list.
3. Extract it to anothert directory:
$ mkdir tmp
$ gcab -xv -C tmp cabfile.cab
...
The files listed as extracted.
Final directory same as the original. Update OK for M5, advisorying.Whiteboard:
MGA5TOO =>
MGA5TOO MGA5-64-OK Mageia 6 :: x86_64 Thanks to Lewis for pathfinding. Installed and exercized the utility before updating. Updated: - gcab-0.7-1.1.mga6.x86_64 - lib64gcab-devel-0.7-1.1.mga6.x86_64 - lib64gcab-gir1.0-0.7-1.1.mga6.x86_64 - lib64gcab1.0_0-0.7-1.1.mga6.x86_64 Followed tests detailed in comment 4. $ cd Documents $ gcab -cv odt.cab *.odt $ ll *.cab -rw-r--r-- 1 lcl lcl 12942584 Feb 5 07:53 odt.cab $ gcab -tv odt.cab abbreviations.odt Apology.odt audit_tasklist.odt .... TV_Licence.odt Untitled 1.odt wingandaprayer.odt $ mkdir tests $ gcab -xv -C tests odt.cab $ ls tests abbreviations.odt Front_1.odt parkingcharge_2.odt ............................ flooding.odt openjpeg.odt wingandaprayer.odt Working for x86_64. CC:
(none) =>
tarazed25
Len Lawrence
2018-02-05 09:01:33 CET
Whiteboard:
MGA5TOO MGA5-64-OK =>
MGA5TOO MGA5-64-OK MGA6-64-OK
Len Lawrence
2018-02-05 23:16:08 CET
Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0111.html Resolution:
(none) =>
FIXED |