PT-2017-9736 · Libarchive+3 · Libarchive+3

Doran Moppert · Published 2016-11-25 · Updated 2024-06-15 · CVE-2016-8688

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive version 3.2.1

Description The issue is related to the mtree bidder in libarchive, which does not properly track line sizes when extending the read-ahead. This allows remote attackers to cause a denial of service, resulting in a crash, by providing a crafted file. The crash is triggered by an invalid read in either the detect form or bid entry function in libarchive/archive read support format mtree.c.

Recommendations For libarchive version 3.2.1, consider restricting the use of the mtree bidder until a patch is available. As a temporary workaround, avoid using the detect form or bid entry functions in libarchive/archive read support format mtree.c to minimize the risk of exploitation.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-1245

CVE-2016-8688

DLA-1600-1

DLA-661-1

OPENSUSE-SU-2024:10127-1

SUSE-SU-2016:2911-1

USN-3225-1

Affected Products

Alt Linux

Suse

Ubuntu

Libarchive

References · 53

• https://github.com/libarchive/libarchive/commit/eec077f52bfa2d3f7103b4b74d52572ba8a15aca · Patch
• https://ubuntu.com/security/CVE-2016-5418 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2016-12/msg00027.html · Vendor Advisory
• https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-memory-corruptionunknown-crash-in-bid_entry-archive_read_support_format_mtree-c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2016:2911-1 · Vendor Advisory
• https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-heap-based-buffer-overflow-in-bid_entry-archive_read_support_format_mtree-c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8688 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8687 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8688 · Security Note
• https://ubuntu.com/security/CVE-2017-5601 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8688 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-8688 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8688 · Security Note
• https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-use-after-free-in-detect_form-archive_read_support_format_mtree-c · Patch
• https://blogs.gentoo.org/ago/2016/09/11/libarchive-bsdtar-use-after-free-in-bid_entry-archive_read_support_format_mtree-c · Patch