Vulnerabilities > CVE-2014-9556 - Numeric Errors vulnerability in Libmspack Project Libmspack 0.4
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 | |
| OS | 2 |
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_SU-2015-2131-1.NASL description This security update fixes the following issues : - Fix possible infinite loop caused DoS (bsc919283, CVE-2014-9556) - Fix zero dereference (bsc#934524, CVE-2014-9732) - Fix off by one (bsc#934527, CVE-2015-4470) - Fix buffer under-read crash (bsc#934528, CVE-2015-4471) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 87122 published 2015-12-01 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/87122 title SUSE SLED11 Security Update : cabextract (SUSE-SU-2015:2131-1) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-064.NASL description Updated cabextract packages fix security vulnerabilities : Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556). A directory traversal issue in cabextract allows writing to locations outside of the current working directory, when extracting a crafted cab file that encodes the filenames in a certain manner (CVE-2015-2060). last seen 2020-06-01 modified 2020-06-02 plugin id 82317 published 2015-03-30 reporter This script is Copyright (C) 2015-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82317 title Mandriva Linux Security Advisory : cabextract (MDVSA-2015:064) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-233.NASL description Upstream published version 0.98.7. This update updates sqeeze-lts to the latest upstream release in line with the approach used for other Debian releases. The changes are not strictly required for operation, but users of the previous version in Squeeze may not be able to make use of all current virus signatures and might get warnings. The bug fixes that are part of this release include security fixes related to packed or crypted files (CVE-2014-9328, CVE-2015-1461, CVE-2015-1462, CVE-2015-1463, CVE-2015-2170, CVE-2015-2221, CVE-2015-2222, and CVE-2015-2668) and several fixes to the embedded libmspack library, including a potential infinite loop in the Quantum decoder (CVE-2014-9556). If you use clamav, we strongly recommend that you upgrade to this version. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-05-29 plugin id 83888 published 2015-05-29 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/83888 title Debian DLA-233-1 : clamav security and upstream version update NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_CC7548EF06E111E58FDA002590263BF5.NASL description There is a denial of service vulnerability in libmspack. The libmspack code is built into cabextract, so it is also vulnerable. MITRE reports : Integer overflow in the qtmd_decompress function in libmspack 0.4 allows remote attackers to cause a denial of service (hang) via a crafted CAB file, which triggers an infinite loop. last seen 2020-06-01 modified 2020-06-02 plugin id 83942 published 2015-06-02 reporter This script is Copyright (C) 2015-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/83942 title FreeBSD : libmspack -- frame_end overflow which could cause infinite loop (cc7548ef-06e1-11e5-8fda-002590263bf5) NASL family Fedora Local Security Checks NASL id FEDORA_2015-3118.NASL description updated to bugfix release 0.5alpha Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81851 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81851 title Fedora 22 : libmspack-0.5-0.1.alpha.fc22 (2015-3118) NASL family SuSE Local Security Checks NASL id SUSE_11_LIBMSPACK-150305.NASL description This update fixes the following security issue : - An integer overflow in the function qtmd_decompress() could have been exploited causing a denial of service (endless loop) (bnc##912214). (CVE-2014-9556) last seen 2020-06-01 modified 2020-06-02 plugin id 81878 published 2015-03-17 reporter This script is Copyright (C) 2015 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81878 title SuSE 11.3 Security Update : libmspack (SAT Patch Number 10402) NASL family Fedora Local Security Checks NASL id FEDORA_2015-3205.NASL description updated to bugfix release 0.5alpha Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81855 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81855 title Fedora 20 : libmspack-0.5-0.1.alpha.fc20 (2015-3205) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2015-041.NASL description Updated cabextract packages fix security vulnerability : Libmspack, a library to provide compression and decompression of some file formats used by Microsoft, is embedded in cabextract. A specially crafted cab file can cause cabextract to hang forever. If cabextract is exposed to any remotely-controlled user input, this issue can cause a denial-of-service (CVE-2014-9556). last seen 2020-06-01 modified 2020-06-02 plugin id 81282 published 2015-02-11 reporter This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81282 title Mandriva Linux Security Advisory : cabextract (MDVSA-2015:041) NASL family Fedora Local Security Checks NASL id FEDORA_2015-3249.NASL description updated to bugfix release 0.5alpha Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2015-03-17 plugin id 81857 published 2015-03-17 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81857 title Fedora 21 : libmspack-0.5-0.1.alpha.fc21 (2015-3249) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-208.NASL description This update fixes previous security update, which was not considered as complete. last seen 2020-06-05 modified 2015-03-10 plugin id 81720 published 2015-03-10 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/81720 title openSUSE Security Update : libmspack (openSUSE-2015-208) NASL family SuSE Local Security Checks NASL id OPENSUSE-2015-87.NASL description libmspack was updated to fix a possible infinite loop caused DoS (bnc912214, CVE-2014-9556). last seen 2020-06-05 modified 2015-02-03 plugin id 81137 published 2015-02-03 reporter This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/81137 title openSUSE Security Update : libmspack (openSUSE-SU-2015:0187-1)
References
- http://advisories.mageia.org/MGASA-2015-0052.html
- http://lists.opensuse.org/opensuse-updates/2015-02/msg00004.html
- http://secunia.com/advisories/62793
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:041
- http://www.openwall.com/lists/oss-security/2015/01/01/5
- http://www.openwall.com/lists/oss-security/2015/01/07/2
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773041