SB2018082227 - Stack-based buffer overflow in libmspack (Alpine package)
Published: August 22, 2018
Security Bulletin ID
SB2018082227
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Stack-based buffer overflow (CVE-ID: CVE-2018-14681)
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The vulnerability exists due to stack-based buffer overflow in the kwajd_read_headers function, as defined in the mspack/kwajd.c source code file. A local attacker can send a specially crafted request that submits malicious input, trigger memory corruption and cause the service to crash or execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=5412962cc2f34d4bb2f2996918e1384eda223946
- https://git.alpinelinux.org/aports/commit/?id=b34c6efbc0f5941d4099a372533f14885013e380
- https://git.alpinelinux.org/aports/commit/?id=be88110b3119e3783d97ab6f259ad7b346dc6203
- https://git.alpinelinux.org/aports/commit/?id=fdb3e21e9339a763b32a76726cb3ee43fd4e8772
- https://git.alpinelinux.org/aports/commit/?id=16c239033cd6df0b08dd57960724a9940cceba82
- https://git.alpinelinux.org/aports/commit/?id=214cb233279c7ef0221557f24d0d0af79a46d3b7
- https://git.alpinelinux.org/aports/commit/?id=3e3519a996d44c6d478d4e1d47cc6360a93da3c3
- https://git.alpinelinux.org/aports/commit/?id=babf8851105592d4bc46ac85ef56f396f9e76c9f
- https://git.alpinelinux.org/aports/commit/?id=c854dba4b5bde88f1673002621ab2bb8e0f66d4b