PT-2007-1032 · Libarchive · Libarchive

Colin Percival

+1

·

Publicado

2007-07-14

·

Atualizado

2017-07-29

·

CVE-2007-3645

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: libarchive versions prior to 2.2.4
Description: The issue allows user-assisted remote attackers to cause a denial of service via specific conditions in tar headers or malformed pax extension headers in PAX or TAR archives, resulting in a NULL pointer dereference. Multiple vulnerabilities in the libarchive package can lead to violations of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.
Recommendations: For versions prior to 2.2.4, update to version 2.2.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of libarchive functions that handle tar and pax headers until a patch is available. Avoid using the archive read support format tar function in archive read support format tar.c until the issue is resolved.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

BDU:2015-02966
BDU:2015-09587
CVE-2007-3645
DSA-1455-1

Produtos afetados

Libarchive