CVE-2010-2800 - The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of servic

CVE-2010-2800

Summary

The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action, related to the libmspack library.

References

Vulnerable Configurations

cpe:2.3:a:cabextract_project:cabextract:0.4:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.4:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.1:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.1:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.3:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.3:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.5:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.5:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.1:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.1:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.2:*:*:*:*:*:*:*
cpe:2.3:a:cabextract_project:cabextract:1.2:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 26-04-2021 - 11:45)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:N/A:P

refmap via4

confirm	http://bugs.gentoo.org/show_bug.cgi?id=329891 http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=90 http://libmspack.svn.sourceforge.net/viewvc/libmspack?view=revision&revision=95 http://www.cabextract.org.uk/#changes https://bugzilla.redhat.com/show_bug.cgi?id=620450
mlist	[oss-security] 20100802 CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (crash) by processing certain .cab files in test archive mode [oss-security] 20100802 Re: CVE Request [two ids] -- cabextract -- 1, Infinite loop in MS-ZIP and Quantum decoders (minor) 2, Integer wrap-around (crash) by processing certain .cab files in test archive mode
vupen	ADV-2010-1903

Last major update

26-04-2021 - 11:45

Published

09-08-2010 - 11:58

Last modified

26-04-2021 - 11:45