CVE-2018-5345

What it actually does

Stack-based buffer overflow in gcab library when parsing specially crafted CAB archives, enabling memory corruption that can lead to process crash or arbitrary code execution.

Why it matters to the business

Systems that extract or inspect CAB files on Linux distributions can be crashed or fully compromised, potentially allowing attackers to gain control of affected workstations or servers and access sensitive data.

How an attack unfolds

An attacker creates a malicious CAB file that triggers the buffer overflow during parsing; the file is delivered to a victim via email, download, or shared storage; when the victim or an automated process opens the archive with gcab or an application using the library, the overflow occurs and attacker-controlled code executes.

How to fix it

Upgrade gcab to a version newer than 0.7.4 on all affected distributions; rebuild or redeploy any dependent packages that statically link the library; replace gcab usage with alternative archive handlers where feasible until updates are applied.

How to confirm the fix worked

Verify installed gcab version is greater than 0.7.4; test parsing of known-good and known-malicious CAB samples in a sandbox to confirm absence of crashes or unexpected behavior; review package manifests for rebuilt dependencies.

Typical attack path

1. Craft a CAB archive containing a payload that overflows a stack buffer in gcab
2. Deliver the malicious file to the target environment
3. Induce the victim or automated process to open or extract the archive
4. Trigger the overflow to achieve code execution or denial of service

How to detect it

Search system and application logs for gcab process crashes or segmentation faults occurring during CAB extraction; inspect file-access logs for unexpected .cab files opened by users or services; review security telemetry for post-crash process creation or privilege escalation attempts originating from archive-handling binaries.

What your security team should do

• Prioritize patching gcab on all Linux systems that process CAB files
• Disable or restrict gcab in environments where CAB handling is unnecessary
• Monitor for new fixed packages from distribution vendors and apply them promptly
• Add archive-handling tools to the list of high-risk components requiring regular inventory