Vulnerability in libarchive - Denial of Service
Summary
DLA-1092-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy6+deb7u1. Fixed in 3.0.4-3+wheezy6+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a multi-format compression library used for creating and extracting various archive formats. It provides functionality for compressing and decompressing files in formats such as tar, cpio, zip, and more. However, a vulnerability has been discovered in libarchive that could lead to a denial of service attack. This vulnerability exists in versions prior to 3.0.4-3+wheezy6+deb7u1 of the Debian 7 Wheezy package.
Vulnerability Detail
The vulnerability in libarchive is caused by a heap-based buffer over-read when processing specially-crafted .xar archives. An attacker can exploit this vulnerability by providing a malicious .xar archive, which could result in a denial of service condition. The heap-based buffer over-read can lead to memory corruption and potentially allow an attacker to execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
3.0.4-3+wheezy6+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the libarchive package in Debian 7 Wheezy is vulnerable to a denial of service attack due to a heap-based buffer over-read issue. To mitigate this vulnerability, it is crucial to upgrade the libarchive package to version 3.0.4-3+wheezy6+deb7u1 or later. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a multi-format compression library used for creating and extracting various archive formats. It provides functionality for compressing and decompressing files in formats such as tar, cpio, zip, and more.
A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system or application, making it unavailable to legitimate users. In the case of this libarchive vulnerability, a specially-crafted .xar archive can cause a denial of service condition by triggering a heap-based buffer over-read.
Exploiting this vulnerability could lead to a denial of service condition, where the affected libarchive-based application crashes or becomes unresponsive. Additionally, if an attacker can execute arbitrary code through the memory corruption, they may be able to gain unauthorized access or perform further malicious actions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application or system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
For more information about this vulnerability, you can refer to the Debian Security Advisory DLA-1092-1 (https://storage.googleapis.com/debian-osv/dla-osv/DLA-1092-1.json).
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
