Directory Traversal Vulnerability in libarchive
Summary
DSA-3180-1: libarchive - security update. Affects libarchive versions < 3.0.4-3+wheezy1. Fixed in 3.0.4-3+wheezy1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libarchive is a library and command-line tool for reading and writing various archive formats. It provides functionality for creating, extracting, and manipulating archives. The vulnerability affects the bsdcpio program, which is part of the libarchive project. bsdcpio is susceptible to a directory traversal vulnerability when handling absolute paths.
Vulnerability Detail
The directory traversal vulnerability in libarchive allows an attacker to bypass file system restrictions and access files outside of the intended directory. By providing a specially crafted absolute path, an attacker can navigate to arbitrary locations on the file system and potentially read or modify sensitive files. This vulnerability can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which libarchive is used.
How To Fix
Minimum fixed version
3.0.4-3+wheezy1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libarchiveTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The directory traversal vulnerability in libarchive can be mitigated by upgrading to the latest version of the libarchive package. It is important to promptly apply the recommended fix to ensure the security and integrity of your system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libarchive →
FAQ
libarchive is a library and command-line tool for reading and writing various archive formats. It provides functionality for creating, extracting, and manipulating archives.
bsdcpio is a program included in the libarchive project that handles cpio archives. It is susceptible to a directory traversal vulnerability.
A directory traversal vulnerability, also known as path traversal or directory climbing, allows an attacker to access files or directories outside of the intended scope. It occurs when insufficient input validation is performed on file paths, allowing attackers to navigate to arbitrary locations on the file system.
The directory traversal vulnerability in libarchive can lead to unauthorized access, data leakage, or even remote code execution. An attacker could read or modify sensitive files on the system, potentially compromising the security and integrity of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for any open-source vulnerabilities, including this directory traversal vulnerability in libarchive.
Related vulnerabilities
Recent vulnerabilities recorded for libarchive.
