Veracode Vulnerability DatabaseVERACODE:21043Improper NULL Byte Parsing
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
libmspack parses NULL bytes in an insecure manner. The chmd_read_headers function in mspack/chmd.c accepts filenames that has \0 as its first or second character. This could allow attackers to bypass input validations or authorization controls.
| CPE | Name | Operator | Version |
|---|---|---|---|
| libmspack | eq | 0.5__0.0.6.alpha.el7 | |
| libmspack | eq | 0.5__0.6.alpha.el7 | |
| libmspack | eq | 0.5__0.0.6.alpha.el7 | |
| libmspack | eq | 0.5__0.6.alpha.el7 |
References
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
access.redhat.com/errata/RHSA-2019:2049
access.redhat.com/security/cve/cve-2018-18585
access.redhat.com/security/updates/classification/#moderate
bugs.debian.org/911637
github.com/kyz/libmspack/commit/8759da8db6ec9e866cb8eb143313f397f925bb4f
lists.debian.org/debian-lts-announce/2018/10/msg00017.html
security.gentoo.org/glsa/201903-20
tools.cisco.com/security/center/viewAlert.x?alertId=59134
usn.ubuntu.com/3814-1/
usn.ubuntu.com/3814-2/
usn.ubuntu.com/3814-3/
www.openwall.com/lists/oss-security/2018/10/22/1
www.starwindsoftware.com/security/sw-20181213-0002/
www.suse.com/security/cve/CVE-2018-18585/
Related
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P