Bug 934525 (CVE-2015-4467)

Summary: VUL-1: CVE-2015-4467: cabextract,libmspack: denial of service while processing crafted CHM file (floating point exception)
Product: [Novell Products] SUSE Security Incidents Reporter: Andreas Stieger <astieger>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P4 - Low CC: meissner, sbrabec, smash_bz, wolfgang.frisch
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/117583/
Whiteboard: CVSSv2:NVD:CVE-2015-4467:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2015-4467:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv2:RedHat:CVE-2015-4472:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Andreas Stieger 2015-06-12 09:24:24 UTC
rh#1180175

The chmd_init_decomp function in chmd.c in libmspack before 0.5 does not
properly validate the reset interval, which allows remote attackers to cause a
denial of service (divide-by-zero error and application crash) via a crafted CHM
file.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1180175
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-4467
http://seclists.org/oss-sec/2015/q2/691
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774726#3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774725
http://anonscm.debian.org/cgit/collab-maint/libmspack.git/commit/?id=a25bb144795e526748b57884daf365732c7e2295
http://anonscm.debian.org/cgit/collab-maint/libmspack.git/diff/debian/patches/fix-division-by-zero.patch?id=a25bb144795e526748b57884daf365732c7e2295

For SLE 11, this needs to be fixed libmspack and cabextract.
For SLE 12, cabextract builds --with-external-libmspack, so only libmspack needs to be fixed.
Comment 1 Swamp Workflow Management 2015-06-12 09:39:54 UTC
An update workflow for this issue was started.
This issue was rated as low.
Please submit fixed packages until 2015-07-10.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/61986
Comment 2 Swamp Workflow Management 2015-06-12 22:02:13 UTC
bugbot adjusting priority
Comment 3 Stanislav Brabec 2015-06-15 18:17:28 UTC
Taking fix-division-by-zero.patch from Debian.
Comment 4 Stanislav Brabec 2015-06-15 19:22:11 UTC
The same is in the upstream as well: https://github.com/kyz/libmspack/commit/b3102f4707a32d60514c06c399c3be4caffd7f25
Comment 6 Stanislav Brabec 2015-06-16 18:42:59 UTC
Backport of this patch to SLE11 libmspack was easy and straightforward:

https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11
Comment 7 Stanislav Brabec 2015-06-16 19:08:08 UTC
Done.

https://build.suse.de/project/show/home:sbrabec:branches:libmspack-security-sle11
libmspack: https://build.suse.de/request/show/60558
cabextract: not affected CHM decompression is not implemented
Comment 13 Swamp Workflow Management 2015-12-07 17:11:54 UTC
SUSE-SU-2015:2215-1: An update that fixes 6 vulnerabilities is now available.

Category: security (moderate)
Bug References: 934524,934525,934526,934527,934528,934529
CVE References: CVE-2014-9732,CVE-2015-4467,CVE-2015-4469,CVE-2015-4470,CVE-2015-4471,CVE-2015-4472
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Server 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Desktop 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Desktop 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    libmspack-0.0.20060920alpha-74.10.1
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    libmspack-0.0.20060920alpha-74.10.1
Comment 14 Swamp Workflow Management 2016-01-04 13:13:10 UTC
SUSE-SU-2016:0011-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 934524,934525,934526,934527,934528,934529
CVE References: CVE-2014-9732,CVE-2015-4467,CVE-2015-4468,CVE-2015-4469,CVE-2015-4470,CVE-2015-4471,CVE-2015-4472
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Software Development Kit 12 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Server 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Server 12 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Desktop 12-SP1 (src):    libmspack-0.4-14.4
SUSE Linux Enterprise Desktop 12 (src):    libmspack-0.4-14.4
Comment 15 Wolfgang Frisch 2020-09-23 15:58:53 UTC
All supported code streams are fixed.