Vulnerability Name:

CVE-2017-1000472

Assigned:2018-01-03
Published:2018-01-03
Updated:2018-01-12
Summary:The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".
CVSS v3 Severity:4.0 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
3.5 Low (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
References:Source: XF
Type: UNKNOWN
poco-cve20171000472-dir-traversal(137216)

Source: MISC
Type: UNKNOWN
https://github.com/pocoproject/poco/issues/1968

Source: DEBIAN
Type: UNKNOWN
DSA-4083

Oval Definitions
Definition IDClassTitleLast Modified
oval:com.ubuntu.xenial:def:20171000472000
V
CVE-2017-1000472 on Ubuntu 16.04 LTS (xenial) - untriaged.
2018-01-03
oval:com.ubuntu.trusty:def:20171000472000
V
CVE-2017-1000472 on Ubuntu 14.04 LTS (trusty) - untriaged.
2018-01-03
BACK