Vulnerabilities > CVE-2016-4302 - Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple products

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL

Summary

Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a zero-sized dictionary.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20160912_LIBARCHIVE_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-03-18
    modified2016-09-13
    plugin id93454
    published2016-09-13
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93454
    titleScientific Linux Security Update : libarchive on SL7.x x86_64 (20160912)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93454);
      script_version("2.6");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/25");
    
      script_cve_id("CVE-2015-8916", "CVE-2015-8917", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8934", "CVE-2016-1541", "CVE-2016-4300", "CVE-2016-4302", "CVE-2016-4809", "CVE-2016-5418", "CVE-2016-5844", "CVE-2016-6250", "CVE-2016-7166");
    
      script_name(english:"Scientific Linux Security Update : libarchive on SL7.x x86_64 (20160912)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Security Fix(es) :
    
      - A flaw was found in the way libarchive handled hardlink
        archive entries of non-zero size. Combined with flaws in
        libarchive's file system sandboxing, this issue could
        cause an application using libarchive to overwrite
        arbitrary files with arbitrary data from the archive.
        (CVE-2016-5418)
    
      - Multiple out-of-bounds write flaws were found in
        libarchive. Specially crafted ZIP, 7ZIP, or RAR files
        could cause a heap overflow, potentially allowing code
        execution in the context of the application using
        libarchive. (CVE-2016-1541, CVE-2016-4300,
        CVE-2016-4302)
    
      - Multiple out-of-bounds read flaws were found in
        libarchive. Specially crafted LZA/LZH, AR, MTREE, ZIP,
        TAR, or RAR files could cause the application to read
        data out of bounds, potentially disclosing a small
        amount of application memory, or causing an application
        crash. (CVE-2015-8919, CVE-2015-8920, CVE-2015-8921,
        CVE-2015-8923, CVE-2015-8924, CVE-2015-8925,
        CVE-2015-8926, CVE-2015-8928, CVE-2015-8934)
    
      - Multiple NULL pointer dereference flaws were found in
        libarchive. Specially crafted RAR, CAB, or 7ZIP files
        could cause an application using libarchive to crash.
        (CVE-2015-8916, CVE-2015-8917, CVE-2015-8922)
    
      - Multiple infinite loop / resource exhaustion flaws were
        found in libarchive. Specially crafted GZIP or ISO files
        could cause the application to consume an excessive
        amount of resources, eventually leading to a crash on
        memory exhaustion. (CVE-2016-7166, CVE-2015-8930)
    
      - A denial of service vulnerability was found in
        libarchive. A specially crafted CPIO archive containing
        a symbolic link to a large target path could cause
        memory allocation to fail, causing an application using
        libarchive that attempted to view or extract such
        archive to crash. (CVE-2016-4809)
    
      - An integer overflow flaw, leading to a buffer overflow,
        was found in libarchive's construction of ISO9660
        volumes. Attempting to create an ISO9660 volume with 2
        GB or 4 GB file names could cause the application to
        attempt to allocate 20 GB of memory. If this were to
        succeed, it could lead to an out of bounds write on the
        heap and potential code execution. (CVE-2016-6250)
    
      - Multiple instances of undefined behavior due to
        arithmetic overflow were found in libarchive. Specially
        crafted MTREE archives, Compress streams, or ISO9660
        volumes could potentially cause the application to fail
        to read the archive, or to crash. (CVE-2015-8931,
        CVE-2015-8932, CVE-2016-5844)"
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1609&L=scientific-linux-errata&F=&S=&P=1167
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?a3fd90f0"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:bsdcpio");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:bsdtar");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libarchive");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libarchive-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fermilab:scientific_linux:libarchive-devel");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/05/07");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/09/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/13");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    os_ver = pregmatch(pattern: "Scientific Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Scientific Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Scientific Linux 7.x", "Scientific Linux " + os_ver);
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"bsdcpio-3.1.2-10.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"bsdtar-3.1.2-10.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libarchive-3.1.2-10.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libarchive-debuginfo-3.1.2-10.el7_2")) flag++;
    if (rpm_check(release:"SL7", cpu:"x86_64", reference:"libarchive-devel-3.1.2-10.el7_2")) flag++;
    
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "bsdcpio / bsdtar / libarchive / libarchive-debuginfo / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-1909-1.NASL
    descriptionlibarchive was updated to fix 20 security issues. These security issues were fixed : - CVE-2015-8918: Overlapping memcpy in CAB parser (bsc#985698). - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser (bsc#985697). - CVE-2015-8920: Stack out of bounds read in ar parser (bsc#985675). - CVE-2015-8921: Global out of bounds read in mtree parser (bsc#985682). - CVE-2015-8922: NULL pointer access in 7z parser (bsc#985685). - CVE-2015-8923: Unclear crashes in ZIP parser (bsc#985703). - CVE-2015-8924: Heap buffer read overflow in tar (bsc#985609). - CVE-2015-8925: Unclear invalid memory read in mtree parser (bsc#985706). - CVE-2015-8926: NULL pointer access in RAR parser (bsc#985704). - CVE-2015-8928: Heap out of bounds read in mtree parser (bsc#985679). - CVE-2015-8929: Memory leak in tar parser (bsc#985669). - CVE-2015-8930: Endless loop in ISO parser (bsc#985700). - CVE-2015-8931: Undefined behavior / signed integer overflow in mtree parser (bsc#985689). - CVE-2015-8932: Compress handler left shifting larger than int size (bsc#985665). - CVE-2015-8933: Undefined behavior / signed integer overflow in TAR parser (bsc#985688). - CVE-2015-8934: Out of bounds read in RAR (bsc#985673). - CVE-2016-4300: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo (bsc#985832). - CVE-2016-4301: Stack buffer overflow in the mtree parse_device (bsc#985826). - CVE-2016-4302: Heap buffer overflow in the Rar decompression functionality (bsc#985835). - CVE-2016-4809: Memory allocate error with symbolic links in cpio archives (bsc#984990). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id93185
    published2016-08-29
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93185
    titleSUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2016:1909-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2016:1909-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93185);
      script_version("2.9");
      script_cvs_date("Date: 2019/09/11 11:22:13");
    
      script_cve_id("CVE-2015-8918", "CVE-2015-8919", "CVE-2015-8920", "CVE-2015-8921", "CVE-2015-8922", "CVE-2015-8923", "CVE-2015-8924", "CVE-2015-8925", "CVE-2015-8926", "CVE-2015-8928", "CVE-2015-8929", "CVE-2015-8930", "CVE-2015-8931", "CVE-2015-8932", "CVE-2015-8933", "CVE-2015-8934", "CVE-2016-4300", "CVE-2016-4301", "CVE-2016-4302", "CVE-2016-4809");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2016:1909-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "libarchive was updated to fix 20 security issues. These security
    issues were fixed :
    
      - CVE-2015-8918: Overlapping memcpy in CAB parser
        (bsc#985698).
    
      - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser
        (bsc#985697).
    
      - CVE-2015-8920: Stack out of bounds read in ar parser
        (bsc#985675).
    
      - CVE-2015-8921: Global out of bounds read in mtree parser
        (bsc#985682).
    
      - CVE-2015-8922: NULL pointer access in 7z parser
        (bsc#985685).
    
      - CVE-2015-8923: Unclear crashes in ZIP parser
        (bsc#985703).
    
      - CVE-2015-8924: Heap buffer read overflow in tar
        (bsc#985609).
    
      - CVE-2015-8925: Unclear invalid memory read in mtree
        parser (bsc#985706).
    
      - CVE-2015-8926: NULL pointer access in RAR parser
        (bsc#985704).
    
      - CVE-2015-8928: Heap out of bounds read in mtree parser
        (bsc#985679).
    
      - CVE-2015-8929: Memory leak in tar parser (bsc#985669).
    
      - CVE-2015-8930: Endless loop in ISO parser (bsc#985700).
    
      - CVE-2015-8931: Undefined behavior / signed integer
        overflow in mtree parser (bsc#985689).
    
      - CVE-2015-8932: Compress handler left shifting larger
        than int size (bsc#985665).
    
      - CVE-2015-8933: Undefined behavior / signed integer
        overflow in TAR parser (bsc#985688).
    
      - CVE-2015-8934: Out of bounds read in RAR (bsc#985673).
    
      - CVE-2016-4300: Heap buffer overflow vulnerability in the
        7zip read_SubStreamsInfo (bsc#985832).
    
      - CVE-2016-4301: Stack buffer overflow in the mtree
        parse_device (bsc#985826).
    
      - CVE-2016-4302: Heap buffer overflow in the Rar
        decompression functionality (bsc#985835).
    
      - CVE-2016-4809: Memory allocate error with symbolic links
        in cpio archives (bsc#984990).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=984990"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985609"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985665"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985669"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985673"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985675"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985679"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985682"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985685"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985688"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985689"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985697"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985698"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985700"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985703"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985704"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985706"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985826"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985832"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=985835"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8918/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8919/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8920/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8921/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8922/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8923/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8924/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8925/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8926/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8928/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8929/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8930/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8931/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8932/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8933/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2015-8934/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-4300/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-4301/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-4302/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2016-4809/"
      );
      # https://www.suse.com/support/update/announcement/2016/suse-su-20161909-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?62166a5b"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product :
    
    SUSE Linux Enterprise Software Development Kit 12-SP1:zypper in -t
    patch SUSE-SLE-SDK-12-SP1-2016-1123=1
    
    SUSE Linux Enterprise Server 12-SP1:zypper in -t patch
    SUSE-SLE-SERVER-12-SP1-2016-1123=1
    
    SUSE Linux Enterprise Desktop 12-SP1:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP1-2016-1123=1
    
    To bring your system up-to-date, use 'zypper patch'."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libarchive-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libarchive13");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libarchive13-debuginfo");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/20");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/07/29");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/08/29");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP1", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(1)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP1", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libarchive-debugsource-3.1.2-22.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libarchive13-3.1.2-22.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libarchive13-debuginfo-3.1.2-22.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"1", cpu:"x86_64", reference:"libarchive-debugsource-3.1.2-22.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"1", cpu:"x86_64", reference:"libarchive13-3.1.2-22.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"1", cpu:"x86_64", reference:"libarchive13-debuginfo-3.1.2-22.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libarchive");
    }
    
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0010.NASL
    descriptionAn update of [binutils,ntp,libarchive] packages for PhotonOS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111859
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111859
    titlePhoton OS 1.0: Binutils / Libarchive / Ntp PHSA-2017-0010 (deprecated)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # @DEPRECATED@
    #
    # Disabled on 2/7/2019
    #
    
    # The descriptive text and package checks in this plugin were
    # extracted from VMware Security Advisory PHSA-2017-0010. The text
    # itself is copyright (C) VMware, Inc.
    
    include("compat.inc");
    
    if (description)
    {
      script_id(111859);
      script_version("1.2");
      script_cvs_date("Date: 2019/02/07 18:59:50");
    
      script_cve_id(
        "CVE-2014-9939",
        "CVE-2015-8933",
        "CVE-2016-4300",
        "CVE-2016-4301",
        "CVE-2016-4302",
        "CVE-2016-4809",
        "CVE-2016-5418",
        "CVE-2016-5844",
        "CVE-2016-6250",
        "CVE-2016-7166",
        "CVE-2016-8687",
        "CVE-2016-8688",
        "CVE-2016-8689",
        "CVE-2017-5601",
        "CVE-2017-6451",
        "CVE-2017-6452",
        "CVE-2017-6455",
        "CVE-2017-6458",
        "CVE-2017-6460",
        "CVE-2017-6462",
        "CVE-2017-6463",
        "CVE-2017-6464",
        "CVE-2017-6969"
      );
    
      script_name(english:"Photon OS 1.0: Binutils / Libarchive / Ntp PHSA-2017-0010 (deprecated)");
      script_summary(english:"Checks the rpm output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "This plugin has been deprecated.");
      script_set_attribute(attribute:"description", value:
    "An update of [binutils,ntp,libarchive] packages for PhotonOS has been
    released.");
      # https://github.com/vmware/photon/wiki/Security-Updates-34
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5b02cf41");
      script_set_attribute(attribute:"solution", value:"n/a.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-9939");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/04/12");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/08/17");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:binutils");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:libarchive");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:ntp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:1.0");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"PhotonOS Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list");
    
      exit(0);
    }
    
    exit(0, "This plugin has been deprecated.");
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/PhotonOS/release");
    if (isnull(release) || release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS");
    if (release !~ "^VMware Photon (?:Linux|OS) 1\.0(\D|$)") audit(AUDIT_OS_NOT, "PhotonOS 1.0");
    
    if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu);
    
    flag = 0;
    
    pkgs = [
      "binutils-2.25.1-4.ph1",
      "binutils-debuginfo-2.25.1-4.ph1",
      "binutils-devel-2.25.1-4.ph1",
      "libarchive-3.3.1-1.ph1",
      "libarchive-debuginfo-3.3.1-1.ph1",
      "libarchive-devel-3.3.1-1.ph1",
      "ntp-4.2.8p10-1.ph1",
      "ntp-debuginfo-4.2.8p10-1.ph1"
    ];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"PhotonOS-1.0", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "binutils / libarchive / ntp");
    }
    
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_4A0D9B53395D11E6B3C814DAE9D210B8.NASL
    descriptionHanno Bock and Cisco Talos report : - Out of bounds heap read in RAR parser - Signed integer overflow in ISO parser - TALOS-2016-0152 [CVE-2016-4300]: 7-Zip read_SubStreamsInfo Integer Overflow - TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack Based Buffer Overflow - TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel Heap Overflow
    last seen2020-06-01
    modified2020-06-02
    plugin id91791
    published2016-06-24
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/91791
    titleFreeBSD : libarchive -- multiple vulnerabilities (4a0d9b53-395d-11e6-b3c8-14dae9d210b8)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from the FreeBSD VuXML database :
    #
    # Copyright 2003-2018 Jacques Vidrine and contributors
    #
    # Redistribution and use in source (VuXML) and 'compiled' forms (SGML,
    # HTML, PDF, PostScript, RTF and so forth) with or without modification,
    # are permitted provided that the following conditions are met:
    # 1. Redistributions of source code (VuXML) must retain the above
    #    copyright notice, this list of conditions and the following
    #    disclaimer as the first lines of this file unmodified.
    # 2. Redistributions in compiled form (transformed to other DTDs,
    #    published online in any format, converted to PDF, PostScript,
    #    RTF and other formats) must reproduce the above copyright
    #    notice, this list of conditions and the following disclaimer
    #    in the documentation and/or other materials provided with the
    #    distribution.
    # 
    # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS"
    # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
    # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
    # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS
    # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
    # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
    # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,
    # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(91791);
      script_version("2.6");
      script_cvs_date("Date: 2018/12/19 13:21:18");
    
      script_cve_id("CVE-2015-8934", "CVE-2016-4300", "CVE-2016-4301", "CVE-2016-4302");
    
      script_name(english:"FreeBSD : libarchive -- multiple vulnerabilities (4a0d9b53-395d-11e6-b3c8-14dae9d210b8)");
      script_summary(english:"Checks for updated package in pkg_info output");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote FreeBSD host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Hanno Bock and Cisco Talos report :
    
    - Out of bounds heap read in RAR parser
    
    - Signed integer overflow in ISO parser
    
    - TALOS-2016-0152 [CVE-2016-4300]: 7-Zip read_SubStreamsInfo Integer
    Overflow
    
    - TALOS-2016-0153 [CVE-2016-4301]: mtree parse_device Stack Based
    Buffer Overflow
    
    - TALOS-2016-0154 [CVE-2016-4302]: Libarchive Rar RestartModel Heap
    Overflow"
      );
      # http://openwall.com/lists/oss-security/2016/06/23/6
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.openwall.com/lists/oss-security/2016/06/23/6"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://github.com/libarchive/libarchive/issues/521"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://github.com/libarchive/libarchive/issues/717#event-697151157"
      );
      # http://blog.talosintel.com/2016/06/the-poisoned-archives.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://blog.talosintelligence.com/2016/06/the-poisoned-archives.html"
      );
      # https://vuxml.freebsd.org/freebsd/4a0d9b53-395d-11e6-b3c8-14dae9d210b8.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4fc4afda"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:libarchive");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/06/23");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/06/23");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/06/24");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"FreeBSD Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("freebsd_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD");
    if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (pkg_test(save_report:TRUE, pkg:"libarchive<3.2.1,1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1470.NASL
    descriptionAccording to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libarchive. A specially crafted MTREE file could cause a small out-of-bounds read, potentially disclosing a small amount of application memory.(CVE-2015-8925) - A vulnerability was found in libarchive. An attempt to create an ISO9660 volume with 2GB or 4GB filenames could cause the application to crash.(CVE-2016-6250) - A vulnerability was found in libarchive. A specially crafted RAR file could cause the application to read memory beyond the end of the decompression buffer.(CVE-2015-8934) - A vulnerability was found in libarchive
    last seen2020-06-01
    modified2020-06-02
    plugin id124794
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124794
    titleEulerOS Virtualization 3.0.1.0 : libarchive (EulerOS-SA-2019-1470)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3657.NASL
    descriptionHanno Boeck and Marcin Noga discovered multiple vulnerabilities in libarchive; processing malformed archives may result in denial of service or the execution of arbitrary code.
    last seen2020-06-01
    modified2020-06-02
    plugin id93238
    published2016-08-31
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93238
    titleDebian DSA-3657-1 : libarchive - security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2016-1045.NASL
    descriptionAccording to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-05-06
    modified2017-05-01
    plugin id99808
    published2017-05-01
    reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/99808
    titleEulerOS 2.0 SP1 : libarchive (EulerOS-SA-2016-1045)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-554.NASL
    descriptionSeveral vulnerabilities were discovered in libarchive, a library for reading and writing archives in various formats. An attacker can take advantage of these flaws to cause a denial of service against an application using the libarchive library (application crash), or potentially execute arbitrary code with the privileges of the user running the application. For Debian 7
    last seen2020-03-17
    modified2016-07-22
    plugin id92500
    published2016-07-22
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92500
    titleDebian DLA-554-1 : libarchive security update
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0010_LIBARCHIVE.NASL
    descriptionAn update of the libarchive package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121677
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121677
    titlePhoton OS 1.0: Libarchive PHSA-2017-0010
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2016-1844.NASL
    descriptionAn update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es) : * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-06-01
    modified2020-06-02
    plugin id93450
    published2016-09-13
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93450
    titleRHEL 7 : libarchive (RHSA-2016:1844)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2016-1844.NASL
    descriptionFrom Red Hat Security Advisory 2016:1844 : An update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es) : * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-06-01
    modified2020-06-02
    plugin id93446
    published2016-09-13
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93446
    titleOracle Linux 7 : libarchive (ELSA-2016-1844)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3033-1.NASL
    descriptionHanno Bock discovered that libarchive contained multiple security issues when processing certain malformed archive files. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8916, CVE-2015-8917 CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8922, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8930, CVE-2015-8931, CVE-2015-8932, CVE-2015-8933, CVE-2015-8934, CVE-2016-5844) Marcin
    last seen2020-06-01
    modified2020-06-02
    plugin id92312
    published2016-07-15
    reporterUbuntu Security Notice (C) 2016-2019 Canonical, Inc. / NASL script (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/92312
    titleUbuntu 12.04 LTS / 14.04 LTS / 15.10 / 16.04 LTS : libarchive vulnerabilities (USN-3033-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-969.NASL
    descriptionlibarchive was updated to fix 20 security issues. These security issues were fixed : - CVE-2015-8918: Overlapping memcpy in CAB parser (bsc#985698). - CVE-2015-8919: Heap out of bounds read in LHA/LZH parser (bsc#985697). - CVE-2015-8920: Stack out of bounds read in ar parser (bsc#985675). - CVE-2015-8921: Global out of bounds read in mtree parser (bsc#985682). - CVE-2015-8922: NULL pointer access in 7z parser (bsc#985685). - CVE-2015-8923: Unclear crashes in ZIP parser (bsc#985703). - CVE-2015-8924: Heap buffer read overflow in tar (bsc#985609). - CVE-2015-8925: Unclear invalid memory read in mtree parser (bsc#985706). - CVE-2015-8926: NULL pointer access in RAR parser (bsc#985704). - CVE-2015-8928: Heap out of bounds read in mtree parser (bsc#985679). - CVE-2015-8929: Memory leak in tar parser (bsc#985669). - CVE-2015-8930: Endless loop in ISO parser (bsc#985700). - CVE-2015-8931: Undefined behavior / signed integer overflow in mtree parser (bsc#985689). - CVE-2015-8932: Compress handler left shifting larger than int size (bsc#985665). - CVE-2015-8933: Undefined behavior / signed integer overflow in TAR parser (bsc#985688). - CVE-2015-8934: Out of bounds read in RAR (bsc#985673). - CVE-2016-4300: Heap buffer overflow vulnerability in the 7zip read_SubStreamsInfo (bsc#985832). - CVE-2016-4301: Stack-based buffer overflow in the mtree parse_device (bsc#985826). - CVE-2016-4302: Heap buffer overflow in the Rar decompression functionality (bsc#985835). - CVE-2016-4809: Memory allocate error with symbolic links in cpio archives (bsc#984990). This update was imported from the SUSE:SLE-12:Update update project.
    last seen2020-06-05
    modified2016-08-16
    plugin id92975
    published2016-08-16
    reporterThis script is Copyright (C) 2016-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/92975
    titleopenSUSE Security Update : libarchive (openSUSE-2016-969)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2016-1844.NASL
    descriptionAn update for libarchive is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, and several popular desktop file managers. Security Fix(es) : * A flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-06-01
    modified2020-06-02
    plugin id93541
    published2016-09-16
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93541
    titleCentOS 7 : libarchive (CESA-2016:1844)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201701-03.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201701-03 (libarchive: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in libarchive. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to open a specially crafted archive file possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id96234
    published2017-01-03
    reporterThis script is Copyright (C) 2017 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/96234
    titleGLSA-201701-03 : libarchive: Multiple vulnerabilities
  • NASL familyAmazon Linux Local Security Checks
    NASL idALA_ALAS-2016-743.NASL
    descriptionA flaw was found in the way libarchive handled hardlink archive entries of non-zero size. Combined with flaws in libarchive
    last seen2020-06-01
    modified2020-06-02
    plugin id93744
    published2016-09-28
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93744
    titleAmazon Linux AMI : libarchive (ALAS-2016-743)

Redhat

advisories
rhsa
idRHSA-2016:1844
rpms
  • bsdcpio-0:3.1.2-10.el7_2
  • bsdtar-0:3.1.2-10.el7_2
  • libarchive-0:3.1.2-10.el7_2
  • libarchive-debuginfo-0:3.1.2-10.el7_2
  • libarchive-devel-0:3.1.2-10.el7_2

Seebug

bulletinFamilyexploit
description### SUMMARY An exploitable heap overflow vulnerability exists in the Rar decompression functionality of libarchive. A specially crafted Rar file can cause a heap corruption eventually leading to code execution. An attacker can send a malformed file to trigger this vulnerability. ### TESTED VERSIONS libarchive git version on date 02.12.2015 Platform : x86/x64 ### PRODUCT URLs https://github.com/libarchive/libarchive ### CVSSv3 SCORE 7.8 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSSv3 Calculator: https://www.first.org/cvss/calculator/3.0 ### DETAILS Here we see the execution flow leading to heap corruption: ``` archive_read_next_header archive_read_format_rar_read_header head_type : 0x72 head_type : 0x73 head_type : 0x74 read_header rar->packed_size : 0x1 rar->dictionary_size = 0; archive_format_name : RAR archive_read_extract rar->compression_method : 0x31 read_data_compressed archive_read_format_rar_read_header head_type : 0x7a read_header parse_codes if (ppmd_flags & 0x20) archive_read_format_rar_read_header head_type : 0x7b archive_read_format_rar_read_header head_type : 0x74 read_header rar->packed_size : 0x1 rar->dictionary_size = 0; archive_read_format_rar_read_header head_type : 0x7a read_header rar->dictionary_size : 0x10000000 archive_read_format_rar_read_header head_type : 0x7b archive_read_format_rar_read_header head_type : 0x74 read_header rar->packed_size : 0x1 rar->dictionary_size = 0; archive_read_format_rar_read_header archive_read_format_rar_read_header __archive_ppmd7_functions.PpmdRAR_RangeDec_CreateVTable(&rar->range_dec); ppmd_alloc : 0 archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header archive_read_format_rar_read_header Ppmd7_Init RestartModel *** Heap corruption *** ``` Let's focus on extraction phase, so everyting below archive_read_extract. The key variable/field here is rar->dictionary_size. First we see that its value is set to: ``` rar->dictionary_size : 0x10000000 libarchive\archive_read_support_format_rar.c Line 2073 /* Memory is allocated in MB */ Line 2074 if (ppmd_flags & 0x20) Line 2075 { Line 2076 if (!rar_br_read_ahead(a, br, 8)) Line 2077 goto truncated_data; Line 2078 rar->dictionary_size = (rar_br_bits(br, 8) + 1) << 20; Line 2079 rar_br_consume(br, 8); Line 2080 } ``` Next, because of small value of "packed_size": ``` rar->packed_size : 0x1 ``` Another portion of data is read from file and parsed like during "reading phase" in archive_read_next_header by calling archive_read_format_rar_read_header and read_header functions. During one of these calls, we see that value of dictionary_size is set to zero. Next allocation for Ppmd context depends on the value of dictionary_size: ``` libarchive\archive_read_support_format_rar.c Line 2115 if ( !__archive_ppmd7_functions.Ppmd7_Alloc(&rar->ppmd7_context,rar->dictionary_size, &g_szalloc) ) libarchive\archive_ppmd7.c Line 125 static Bool Ppmd7_Alloc(CPpmd7 *p, UInt32 size, ISzAlloc *alloc) Line 126 { Line 127 if (p->Base == 0 || p->Size != size) Line 128 { Line 129 Ppmd7_Free(p, alloc); Line 130 p->AlignOffset = Line 131 #ifdef PPMD_32BIT Line 132 (4 - size) & 3; Line 133 #else Line 134 4 - (size & 3); Line 135 #endif Line 136 if ((p->Base = (Byte *)alloc->Alloc(alloc, p->AlignOffset + size Line 137 #ifndef PPMD_32BIT Line 138 + UNIT_SIZE Line 139 #endif Line 140 )) == 0) Line 141 return False; Line 142 p->Size = size; Line 143 } Line 144 return True; Line 145 } ``` As we can see for dictionary_size equal 0 we will have allocation made for 0 bytes: ``` python import gdbheap p p->Base $5 = (Byte *) 0x80e2480 " \b\r\brn" heap select size==16 Reading in symbols for malloc.c...done. Start End Domain Kind Detail Hexdump ---------- ---------- ------------- ----------- -------- ---------------------------------------------------------------------------------- 0x080d0798 0x080d07a7 uncategorized 16 bytes a8 07 0d 08 03 00 00 00 57 4d 54 00 19 00 00 00 c0 07 0d 08 |........WMT.........| 0x080d07c0 0x080d07cf uncategorized 16 bytes d0 07 0d 08 03 00 00 00 43 45 54 00 19 00 00 00 e8 07 0d 08 |........CET.........| 0x080d07e8 0x080d07f7 uncategorized 16 bytes 00 00 00 00 03 00 00 00 45 45 54 00 21 00 00 00 72 61 72 2d |........EET.!...rar-| 0x080d0818 0x080d0827 uncategorized 16 bytes 00 00 00 00 50 a4 d8 f7 00 00 00 00 11 00 00 00 50 70 6d 64 |....P...........Ppmd| 0x080d0828 0x080d0837 C string data 50 70 6d 64 37 5f 49 6e 69 74 0a 00 21 00 00 00 44 00 00 00 |Ppmd7_Init..!...D...| 0x080d0cd8 0x080d0ce7 uncategorized 16 bytes e8 0c 0d 08 00 00 00 00 00 00 00 00 f9 01 00 00 c5 b0 01 c0 |....................| 0x080e2470 0x080e247f uncategorized 16 bytes 00 69 62 61 32 2e 68 74 6d 6c c0 cc 11 00 00 00 20 08 0d 08 |.iba2.html...... ...| 0x080e2480 0x080e248f C string data 20 08 0d 08 72 6e 00 00 00 00 00 00 21 00 00 00 72 61 72 2d | ...rn......!...rar-| ``` Finally we land in RestartModel function: ``` libarchive\archive_ppmd7.c Line 314 static void RestartModel(CPpmd7 *p) Line 315 { Line 316 unsigned i, k, m; Line 317 Line 318 memset(p->FreeList, 0, sizeof(p->FreeList)); Line 319 p->Text = p->Base + p->AlignOffset; Line 320 p->HiUnit = p->Text + p->Size; Line 321 p->LoUnit = p->UnitsStart = p->HiUnit - p->Size / 8 / UNIT_SIZE * 7 * UNIT_SIZE; Line 322 p->GlueCount = 0; Line 323 Line 324 p->OrderFall = p->MaxOrder; Line 325 p->RunLength = p->InitRL = -(Int32)((p->MaxOrder < 12) ? p->MaxOrder : 12) - 1; Line 326 p->PrevSuccess = 0; Line 327 Line 328 p->MinContext = p->MaxContext = (CTX_PTR)(p->HiUnit -= UNIT_SIZE); /* AllocContext(p); */ Line 329 p->MinContext->Suffix = 0; Line 330 p->MinContext->NumStats = 256; Line 331 p->MinContext->SummFreq = 256 + 1; Line 332 p->FoundState = (CPpmd_State *)p->LoUnit; /* AllocUnits(p, PPMD_NUM_INDEXES - 1); */ Line 333 p->LoUnit += U2B(256 / 2); Line 334 p->MinContext->Stats = REF(p->FoundState); ``` The key values here are: ``` p p->AlignOffset $6 = 0 p p->Size $7 = 0 ``` As we can see above both equal 0 which has consequences in line 328 where UNIT_SIZE (12) is subtracted from p->HiUnit pointer and assigned to p->MinContext: When everything is correct p->HiUnit first is set at the end of allocated space for Ppmd context, but because AlignOffset and Size is equal 0 it still points to the beginning. In result of this substraction p->MinContext is set to the inside of previous heap chunk space. ``` p p->MinContext $8 = (CPpmd7_Context *) 0x80e2474 heap: 0x080e2470 0x080e247f uncategorized 16 bytes 00 69 62 61 32 2e 68 74 6d 6c c0 cc 11 00 00 00 20 08 0d 08 |.iba2.html...... ...| 0x080e2480 0x080e248f C string data 20 08 0d 08 72 6e 00 00 00 00 00 00 21 00 00 00 72 61 72 2d | ...rn......!...rar-| ``` Further writes to this structure overwrite heap chunks: ``` Heap check before execution of line 329: python from heap.glibc import * python print MChunkPtr(gdb.Value(0x080e2480-8).cast(MChunkPtr.gdb_type())) <MChunkPtr chunk=0x80e2478 mem=0x80e2480 PREV_INUSE inuse chunksize=16 memsize=8> After execution: python print MChunkPtr(gdb.Value(0x080e2480-8).cast(MChunkPtr.gdb_type())) <MChunkPtr chunk=0x80e2478 mem=0x80e2480 prev_size=3435162733 free chunksize=0 memsize=-8> ``` ### CRASH INFORMATION ``` Valgrind Output: ==13328== Memcheck, a memory error detector ==13328== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==13328== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info ==13328== Command: libarchive-pure32/bin/ext /home/icewall/samples/rar/pmd7.rar rar ==13328== ==13328== Invalid write of size 4 ==13328== at 0x809C4D4: RestartModel (archive_ppmd7.c:329) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c06c is 4 bytes before a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 2 ==13328== at 0x809C4E0: RestartModel (archive_ppmd7.c:330) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c064 is 12 bytes before a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 2 ==13328== at 0x809C4EA: RestartModel (archive_ppmd7.c:331) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c066 is 10 bytes before a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 4 ==13328== at 0x809C519: RestartModel (archive_ppmd7.c:334) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c068 is 8 bytes before a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 1 ==13328== at 0x809C543: RestartModel (archive_ppmd7.c:338) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c070 is 0 bytes after a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 1 ==13328== at 0x809C548: RestartModel (archive_ppmd7.c:339) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== by 0x804A45A: main (ext.c:85) ==13328== Address 0x445c071 is 1 bytes after a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 2 ==13328== at 0x809C3CC: SetSuccessor (archive_ppmd7.c:310) ==13328== by 0x809C55E: RestartModel (archive_ppmd7.c:340) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== Address 0x445c072 is 2 bytes after a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ==13328== Invalid write of size 2 ==13328== at 0x809C3DB: SetSuccessor (archive_ppmd7.c:311) ==13328== by 0x809C55E: RestartModel (archive_ppmd7.c:340) ==13328== by 0x809C693: Ppmd7_Init (archive_ppmd7.c:364) ==13328== by 0x807C20F: parse_codes (archive_read_support_format_rar.c:2128) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== Address 0x445c074 is 4 bytes after a block of size 0 alloc'd ==13328== at 0x402A17C: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so) ==13328== by 0x80783CC: ppmd_alloc (archive_read_support_format_rar.c:611) ==13328== by 0x809BD73: Ppmd7_Alloc (archive_ppmd7.c:136) ==13328== by 0x807C190: parse_codes (archive_read_support_format_rar.c:2115) ==13328== by 0x807B8CA: read_data_compressed (archive_read_support_format_rar.c:1919) ==13328== by 0x8079049: archive_read_format_rar_read_data (archive_read_support_format_rar.c:1025) ==13328== by 0x804ED6B: _archive_read_data_block (archive_read.c:982) ==13328== by 0x8091B3B: archive_read_data_block (archive_virtual.c:161) ==13328== by 0x805083C: copy_data (archive_read_extract2.c:139) ==13328== by 0x8050770: archive_read_extract2 (archive_read_extract2.c:101) ==13328== by 0x80505CE: archive_read_extract (archive_read_extract.c:59) ==13328== by 0x804A3E2: extract (ext.c:63) ==13328== ``` ### TIMELINE * 2016-04-19 - Vendor Disclosure * 2016-06-18 - Public Release
idSSV:96753
last seen2017-11-19
modified2017-10-20
published2017-10-20
reporterRoot
titleLibarchive Rar RestartModel Code Execution Vulnerability(CVE-2016-4302)

Talos

idTALOS-2016-0154
last seen2019-05-29
published2016-06-19
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2016-0154
titleLibarchive Rar RestartModel Code Execution Vulnerability