Vulnerability in POCO C++ Libraries allows arbitrary file creation or overwrite
Summary
DLA-1239-1: poco - security update. Affects poco versions < 1.3.6p1-4+deb7u1. Fixed in 1.3.6p1-4+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
POCO C++ Libraries is a set of open-source C++ class libraries that simplify and accelerate the development of network-centric, portable applications. It provides various modules for handling network protocols, file systems, and more. The library is widely used in the development of cross-platform applications.
Vulnerability Detail
The ZipCommon::isValidPath() function in POCO C++ Libraries before version 1.8 does not properly validate the filename value in the ZIP header. This allows an attacker to perform absolute path traversal attacks during ZIP decompression. By crafting a malicious ZIP file, an attacker can exploit this vulnerability to create or overwrite arbitrary files on the system. This vulnerability is related to a file path injection vulnerability.
How To Fix
Minimum fixed version
1.3.6p1-4+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade pocoTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of POCO C++ Libraries.
Conclusion
The vulnerability in POCO C++ Libraries allows an attacker to create or overwrite arbitrary files on the system by exploiting a path traversal vulnerability during ZIP decompression. To mitigate this issue, it is crucial to upgrade to the patched version of the library. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for poco →
FAQ
POCO C++ Libraries is a collection of open-source C++ class libraries that provide reusable components for network-centric, portable application development.
This vulnerability allows an attacker to create or overwrite arbitrary files on the system by exploiting a path traversal vulnerability during ZIP decompression.
To fix this vulnerability, upgrade the POCO C++ Libraries to version 1.3.6p1-4+deb7u1 or later.
No, there is no known workaround for this vulnerability. It is necessary to apply the recommended fix by upgrading the library.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for poco.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
