PT-2018-2640 · Libarchive+5 · Libarchive+5
Publicado
2018-11-20
·
Atualizado
2024-06-15
·
CVE-2018-1000878
CVSS v2.0
9.3
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
libarchive versions 3.1.0 and later
Description
The issue is related to a CWE-416: Use After Free vulnerability in the RAR decoder of the libarchive library, specifically in the file libarchive/archive read support format rar.c. This vulnerability can result in a Crash or Denial of Service (DoS) and potentially allow for remote code execution (RCE), although the possibility of RCE is unknown. The attack appears to be exploitable if a victim opens a specially crafted RAR archive.
Recommendations
For libarchive versions 3.1.0 and later, consider avoiding the use of the RAR decoder until a patch is available. As a temporary workaround, restrict access to the vulnerable
libarchive/archive read support format rar.c file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.DoS
RCE
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Ubuntu
Libarchive