Resource exhaustion in libarchive - CVE-2019-1000020

Vulnerability identifier: #VU20541

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-1000020

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper parsing of ISO9660 files. A remote attacker can  persuade a user to access an ISO9660, trigger an infinite loop condition and perform a denial of service (DoS) attack.

libarchive
Arch Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
BIG-IP
libarchive
Data Computing Appliance (DCA)

Install updates from vendor's website.

libarchive - update to 3.3.1
libarchive - addressed in versions 3.3.3-6.fc28, 3.3.3-6.fc29, 3.3.3-6.fc30
Data Computing Appliance (DCA) - update to 4.3.0.0

• https://github.com/libarchive/libarchive/pull/1120
• https://github.com/libarchive/libarchive/pull/1120/commits/8312eaa576014cd9b965012af51bc1f967b12423

• Denial of service in libarchive
• OpenSUSE Linux update for libarchive
• Arch Linux update for libarchive
• Red Hat update for libarchive
• Amazon Linux AMI update for libarchive
• Red Hat update for libarchive
• OpenSUSE Linux update for libarchive
• OpenSUSE Linux update for libarchive
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Multiple vulnerabilities in F5 BIG-IP configuration and tmsh utilities
• Fedora 28 update for libarchive
• Fedora 30 update for libarchive
• Fedora 29 update for libarchive