PT-2018-3463 · Libarchive+2 · Libarchive+2

Daxtens · Publicado 2018-12-20 · Atualizado 2024-06-15 · CVE-2018-1000879

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: libarchive versions commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards)

Description: The issue is related to a NULL pointer dereference in the archive acl from text l() function of the libarchive library. This can be exploited by a remote attacker using a specially crafted archive file, potentially leading to a denial of service. The exploitation requires the victim to open the malicious archive.

Recommendations: For libarchive versions commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards), consider avoiding the use of the archive acl from text l() function until a patch is available. As a temporary workaround, restrict access to specially crafted archive files to minimize the risk of exploitation.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2019-2522

ALT-PU-2019-3125

BDU:2020-01816

CVE-2018-1000879

MGASA-2019-0030

OPENSUSE-SU-2019:1196-1

OPENSUSE-SU-2019_1196-1

OPENSUSE-SU-2024:10925-1

SUSE-SU-2019:0831-1

Produtos afetados

Alt Linux

Suse

Libarchive

Referências · 51

• https://github.com/libarchive/libarchive/pull/1105 · Nota
• https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000879 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-19221 · Nota
• https://osv.dev/vulnerability/CVE-2018-1000879 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-01816 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000879 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG · Aviso do Fabricante
• http://lists.suse.com/pipermail/sle-security-updates/2018-December/004927.html · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-18408 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=24075 · Nota
• https://suse.com/security/cve/CVE-2018-1000879 · Nota
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Aviso do Fabricante