Bug 15211 - cabextract hangs on special crafte cab files
Summary: cabextract hangs on special crafte cab files
Status: RESOLVED DUPLICATE of bug 15193
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 4
Hardware: All Linux
Priority: High critical
Target Milestone: ---
Assignee: Shlomi Fish
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-06 01:47 CET by Thomas Spuhler
Modified: 2015-02-06 03:25 CET (History)
1 user (show)

See Also:
Source RPM: cabextract-1.5
CVE:
Status comment:


Attachments
file that causes the infinite loop (268 bytes, text/plain)
2015-02-06 01:49 CET, Thomas Spuhler
Details

Description Thomas Spuhler 2015-02-06 01:47:07 CET
Description of problem:
Cabextract goes into an infinite loop when trying to expand a special crafted .cab file as attached. This seems to originate in a bug in the embeded libmspack.
Contrary to the report, clamav doesn't show this behavior.
See bug # 15155
This causes a security issue in amavisd and can cause a DoS attack.

http://openwall.com/lists/oss-security/2015/02/03/12
http://lwn.net/Vulnerabilities/631508/
http://lists.opensuse.org/opensuse-updates/2015-02/msg00004.html

Version-Release number of selected component (if applicable):
1.5

How reproducible:
every time


Steps to Reproduce:
1. save the attached hang.cab file and run cabextract hang.cab. 
2. you will get the output:
Extracting cabinet: hang.cab
  extracting limeric
3. Here it hangs and I had to cancel it after two hours.


Reproducible: 

Steps to Reproduce:
Comment 1 Thomas Spuhler 2015-02-06 01:49:13 CET
Created attachment 5861 [details]
file that causes the infinite loop
Thomas Spuhler 2015-02-06 01:50:01 CET

Priority: Normal => High
Status: NEW => ASSIGNED
CC: (none) => thomas
Assignee: bugsquad => shlomif

Comment 2 David Walser 2015-02-06 03:25:32 CET
Already fixed.

*** This bug has been marked as a duplicate of bug 15193 ***

Status: ASSIGNED => RESOLVED
Resolution: (none) => DUPLICATE


Note You need to log in before you can comment on or make changes to this bug.