REDHAT-BUG-1185717: Low severity unshield unshield vulnerability

Published Jan 26, 2015

Updated

Jakub Wilk reports:

Package: unshield Version: 1.0-1 Tags: security

unshield is vulnerable to directory traversal via "../" sequences. As a proof of concept, unpacking the attached InstallShield archive creates a file in /tmp:

$ ls /tmp/moo ls: cannot access /tmp/moo: No such file or directory

$ unshield x data1.cab Cabinet: data1.cab extracting: ./BovineFiles/../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/moo -------- ------- 1 files

$ ls /tmp/moo /tmp/moo

-- System Information: Debian Release: 8.0 APT prefers unstable APT policy: (990, 'unstable'), (500, 'experimental') Architecture: i386 (x8664) Foreign Architectures: amd64

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores) Locale: LANG=C, LCCTYPE=plPL.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: sysvinit (via /sbin/init)

Affected Software

1 affected component

unshield unshield

Event History

Jan 26, 2015

Data Sourced

via Red Hat·05:50 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems are exposed when they use unshield to extract an attacker-controlled or otherwise untrusted InstallShield cabinet archive.

What does an attacker need to exploit it?

An attacker needs to provide a crafted cabinet containing file paths with ../ sequences and have a user or process extract it with unshield.

What is the practical impact of exploitation?

Extraction can write files outside the intended output directory. The provided proof of concept creates /tmp/moo despite extracting the archive from the current directory.

How can I determine whether an extraction was affected?

Review the archive's recorded extraction paths and inspect for files created outside the selected destination directory, especially paths containing ../ components. Check sensitive or unexpected locations that the extracting process could write to.

REDHAT-BUG-1185717: Low severity unshield unshield vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of exploitation?

How can I determine whether an extraction was affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the practical impact of exploitation?

How can I determine whether an extraction was affected?