Out-of-Bounds Read Vulnerability in libarchive: CVE-2017-5601
Summary
ALPINE-CVE-2017-5601: An error in the lha_read_file_header_1() function (archive_read_support_format_lha.c) in libarchive 3.2.2 allows remote attackers to trigger an out-of-bounds read memory access and subsequently cause a crash via a specia... Affects libarchive versions < 3.2.2-r0. Fixed in 3.2.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a widely-used library that provides a flexible interface for reading and writing archive files. It supports various archive formats, allowing developers to handle compressed files efficiently. However, libarchive versions prior to 3.2.2-r0 for Alpine v3.4 and 3.2.2-r1 for Alpine v3.5 are vulnerable to an out-of-bounds read, which can lead to application crashes when processing specially crafted archives.
Vulnerability Detail
The vulnerability stems from an error in the lha_read_file_header_1() function located in archive_read_support_format_lha.c within libarchive version 3.2.2. This flaw allows remote attackers to exploit the library by sending specially crafted archive files, triggering an out-of-bounds read memory access. The consequences of this vulnerability can lead to application crashes, potentially affecting the availability of services that rely on libarchive for archive handling.
How To Fix
Minimum fixed version
3.2.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing input validation to reject untrusted or malformed archive files. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
CVE-2017-5601 is a significant vulnerability in the libarchive library that can lead to application crashes due to out-of-bounds memory access. It is crucial for users of affected versions to update their packages promptly to ensure the security and stability of their applications.
See every vulnerability recorded for libarchive →
FAQ
CVE-2017-5601 is a vulnerability in the libarchive library that allows remote attackers to cause an out-of-bounds read memory access, leading to application crashes.
libarchive versions prior to 3.2.2-r0 for Alpine v3.4 and 3.2.2-r1 for Alpine v3.5 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without any installation.
The vulnerability can lead to application crashes, affecting the availability and reliability of services that utilize the libarchive library.
Implement input validation to reject untrusted or malformed archive files as a temporary workaround until the package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
