PT-2019-5201 · Flightcrew+1 · Flightcrew+1

Mike Salvatore · Published 2019-06-26 · Updated 2023-02-28 · CVE-2019-13241

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FlightCrew versions 0.9.2 and older

Description The issue is related to insufficient input validation in the EPUB validator, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction. This can enable an attacker to record arbitrary files in any directory of the Zip archive.

Recommendations For FlightCrew versions 0.9.2 and older, as a temporary workaround, consider restricting the handling of ZIP archive entries to prevent directory traversal attacks until a patch is available. Avoid using the ZIP extraction feature with untrusted archives until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

BDU:2020-01892

CVE-2019-13241

MGASA-2019-0396

USN-4055-1

Affected Products

Flightcrew

Ubuntu

References · 18

• 🔥 https://github.com/Sigil-Ebook/flightcrew/issues/52 · Exploit
• 🔥 https://salvatoresecurity.com/fun-with-fuzzers-how-i-discovered-three-vulnerabilities-part-3-of-3 · Exploit
• https://ubuntu.com/security/CVE-2019-13032 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4055-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13241 · Security Note
• https://usn.ubuntu.com/4055-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13241 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13241 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13241 · Security Note
• https://ubuntu.com/security/CVE-2019-13241 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4055-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13453 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2019-0396 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13241 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0396.html · Security Note