CVE-2017-11423

NameCVE-2017-11423
DescriptionThe cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3946-1
NVD severitymedium (attack range: remote)
Debian Bugs868956

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
clamav (PTS)wheezy0.99+dfsg-0+deb7u2vulnerable
wheezy (security)0.99.2+dfsg-0+deb7u3vulnerable
jessie0.99.2+dfsg-0+deb8u2vulnerable
stretch0.99.2+dfsg-6vulnerable
buster, sid0.99.3~beta1+dfsg-2fixed
libmspack (PTS)jessie0.5-1vulnerable
jessie (security)0.5-1+deb8u1fixed
stretch (security), stretch0.5-1+deb9u1fixed
buster, sid0.6-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
clamavsource(unstable)0.99.3~beta1+dfsg-1unimportant
libmspacksource(unstable)0.6-1medium868956
libmspacksourcejessie0.5-1+deb8u1mediumDSA-3946-1
libmspacksourcestretch0.5-1+deb9u1mediumDSA-3946-1

Notes

https://bugzilla.clamav.net/show_bug.cgi?id=11873 (not public)
https://github.com/kyz/libmspack/commit/17038206fcc384dcee6dd9e3a75f08fd3ddc6a38
https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul
ClamAV: https://github.com/vrtadmin/clamav-devel/commit/ffa31264a657618a0e40c51c01e4bfc32e244d13
ClamaV: https://github.com/vrtadmin/clamav-devel/commit/ada5f94e5cfb04e1ac2a6f383f2184753f475b96
ClamAV uses the libmspack system library when available. This is the
case from starting from Debian Jessie. Debian Wheezy does not have
libmspack and thus need to have the fix as well in the src:clamav source package.

Search for package or bug name: Reporting problems