PT-2018-3463 · Libarchive+2 · Libarchive+2

Daxtens · Published 2018-12-20 · Updated 2024-06-15 · CVE-2018-1000879

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: libarchive versions commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards)

Description: The issue is related to a NULL pointer dereference in the archive acl from text l() function of the libarchive library. This can be exploited by a remote attacker using a specially crafted archive file, potentially leading to a denial of service. The exploitation requires the victim to open the malicious archive.

Recommendations: For libarchive versions commit 379867ecb330b3a952fb7bfa7bffb7bbd5547205 onwards (release v3.3.0 onwards), consider avoiding the use of the archive acl from text l() function until a patch is available. As a temporary workaround, restrict access to specially crafted archive files to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-2522

ALT-PU-2019-3125

BDU:2020-01816

CVE-2018-1000879

MGASA-2019-0030

OPENSUSE-SU-2019:1196-1

OPENSUSE-SU-2019_1196-1

OPENSUSE-SU-2024:10925-1

SUSE-SU-2019:0831-1

Affected Products

Alt Linux

Suse

Libarchive

References · 51

• https://github.com/libarchive/libarchive/pull/1105/commits/15bf44fd2c1ad0e3fd87048b3fcc90c4dcff1175 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000879 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000879 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01816 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000879 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W645KCLWFDBDGFJHG57WOVXGE62QSIJI · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1196-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0030.html · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZVXA7PHINVT6DFF6PRLTDTVTXKDLVHNF · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10925-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBOCC2M6YGPZA6US43YK4INPSJZZHRTG · Vendor Advisory