Heap-based buffer overflow in libarchive (Alpine package)

1) Heap-based buffer overflow

EUVDB-ID: #VU33065

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-1541

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Heap-based buffer overflow in the zip_read_mac_metadata function in archive_read_support_format_zip.c in libarchive before 3.2.0. A remote attacker can use crafted entry-size values in a ZIP archive. to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libarchive (Alpine package): 3.0.2-r0 - 3.1.2-r2

IBM Tivoli Storage Manager: before 5.1.5

libarchive (Alpine package): before 0.11

libarchive (Alpine package): before 1.5.3-1

libarchive (Alpine package): before 3.0pl1-116

libarchive (Alpine package): before 0.2.3-2

CPE2.3

• cpe:2.3:a:alpine:libarchive_alpine_package:3.0.2-r0:*:*:*:*:alpine_linux:*:2.1
• cpe:2.3:a:alpine:libarchive_alpine_package:3.0.2-r1:*:*:*:*:alpine_linux:*:2.2
• cpe:2.3:a:alpine:libarchive_alpine_package:3.0.4-r0:*:*:*:*:alpine_linux:*:2.3
• cpe:2.3:a:ibm_corporation:ibm_tivoli_storage_manager:*:*:*:*:*:*:*:*
• cpe:2.3:a:alpine:libarchive_alpine_package:*:*:*:*:*:alpine_linux:*:*
• cpe:2.3:a:alpine:libarchive_alpine_package:*:*:*:*:*:alpine_linux:*:*
• cpe:2.3:a:alpine:libarchive_alpine_package:*:*:*:*:*:alpine_linux:*:*
• cpe:2.3:a:alpine:libarchive_alpine_package:*:*:*:*:*:alpine_linux:*:*

External links

https://git.alpinelinux.org/aports/commit/?id=87822f4ac4adaaafbbee3ffe58ab6eebdc12907e
https://git.alpinelinux.org/aports/commit/?id=99073b453f33a5d1dd05323701be2557e6cd4905
https://git.alpinelinux.org/aports/commit/?id=d8416edf5bf659e7f404b1c624471b6240aa772f
https://git.alpinelinux.org/aports/commit/?id=fd77c7aec807195aafce696698671418dff7d932
https://git.alpinelinux.org/aports/commit/?id=821c39504ab39c05c1102b24d335c73b333d0040
https://git.alpinelinux.org/aports/commit/?id=f3f119d328f0cf56437edc38e278ecd7d8424ec3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.