Directory Traversal Vulnerability in libmspack: A Security Concern
Summary
ALPINE-CVE-2018-18586: chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. Affects libmspack versions < 0.8_alpha-r0. Fixed in 0.8_alpha-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libmspack is an open-source library designed for handling Microsoft compressed files, particularly CHM (Compiled HTML Help) files. It provides functionalities for extracting and manipulating content from these files. However, prior to version 0.8_alpha, the library's sample program, chmextract.c, did not adequately safeguard against absolute and relative pathnames in CHM files, exposing users to potential directory traversal attacks.
Vulnerability Detail
The vulnerability arises from the chmextract.c sample program included with libmspack before version 0.8_alpha. It fails to validate pathnames in CHM files, allowing attackers to exploit this oversight and access arbitrary directories on the system. This could lead to unauthorized file access and data exposure. The vendor contends that this issue is not a direct vulnerability of libmspack itself, as chmextract.c was intended solely as a source code example rather than a supported application.
How To Fix
Minimum fixed version
0.8_alpha-r0
This is the first release that contains the fix.
sudo apk add --upgrade libmspackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the chmextract.c sample program until they have updated to the patched version. Additionally, users should implement strict access controls and monitor file access permissions to mitigate potential risks.
Conclusion
The directory traversal vulnerability in libmspack's chmextract.c sample program poses a moderate security risk. Users are advised to update to the patched version 0.8_alpha-r0 to mitigate this issue. Employing best practices in file access management can further enhance security.
See every vulnerability recorded for libmspack →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files and directories, posing a significant security risk.
The chmextract.c program is not recommended for use in its current form due to the vulnerability. It is advisable to update to the patched version or avoid using it altogether.
If immediate updates are not possible, implement strict access controls and monitor file permissions to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for libmspack.
