Vulnerabilities > CVE-2007-3644 - Remote vulnerability in Freebsd Libarchive 2.2.3

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
freebsd
nessus
NVD
Published: 2007-07-14
Updated: 2017-07-29

Summary

archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.

Vulnerable Configurations

Part Description Count
Application
Freebsd
2

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_LIBARCHIVE-3982.NASL
    descriptionSpecially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645).
    last seen2020-06-01
    modified2020-06-02
    plugin id27316
    published2007-10-17
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/27316
    titleopenSUSE 10 Security Update : libarchive (libarchive-3982)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1455.NASL
    descriptionSeveral local/remote vulnerabilities have been discovered in libarchive1, a single library to read/write tar, cpio, pax, zip, iso9660 archives. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-3641 It was discovered that libarchive1 would miscompute the length of a buffer resulting in a buffer overflow if yet another type of corruption occurred in a pax extension header. - CVE-2007-3644 It was discovered that if an archive prematurely ended within a pax extension header the libarchive1 library could enter an infinite loop. - CVE-2007-3645 If an archive prematurely ended within a tar header, immediately following a pax extension header, libarchive1 could dereference a NULL pointer.
    last seen2020-06-01
    modified2020-06-02
    plugin id29902
    published2008-01-10
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/29902
    titleDebian DSA-1455-1 : libarchive - denial of service
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200708-03.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200708-03 (libarchive (formerly named as bsdtar): Multiple PaX Extension Header Vulnerabilities) CPNI, CERT-FI, Tim Kientzle, and Colin Percival reported a buffer overflow (CVE-2007-3641), an infinite loop (CVE-2007-3644), and a NULL pointer dereference (CVE-2007-3645) within the processing of archives having corrupted PaX extension headers. Impact : An attacker can trick a user or automated system to process an archive with malformed PaX extension headers into execute arbitrary code, crash an application using the library, or cause a high CPU load. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id25868
    published2007-08-13
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/25868
    titleGLSA-200708-03 : libarchive (formerly named as bsdtar): Multiple PaX Extension Header Vulnerabilities

References