Integer overflow in isoent_gen_joliet_identifier() in libarchive and Oracle Linux - CVE-2016-6250

Vulnerability identifier: #VU215

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-6250

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in libarchive. A remote unauthenticated attacker can cause integer overflow by creating a file with a specially crafted filename that archived as an ISO9660 archive by the target application using libarchive.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libarchive
Oracle Linux
Fedora
libarchive (Alpine package)
python-libarchive-c
libarchive3
mingw-libarchive
libarchive
mingw-xz
IBM Tivoli Storage Manager

Install the latest version: (3.2.1).

libarchive (Alpine package) - update to 3.1.2-r4
python-libarchive-c - update to 2.5-1.fc23
libarchive3 - update to 3.2.1-1.el6
mingw-libarchive - update to 3.2.1-2.fc24
libarchive - addressed in versions 3.2.1-3.fc23, 3.2.1-3.fc24
mingw-xz - update to 5.2.2-3.fc24

• https://github.com/libarchive/libarchive/issues/711
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

• Integer overflow in isoent_gen_joliet_identifier() in libarchive libarchive
• Integer overflow in isoent_gen_joliet_identifier() in libarchive (Alpine package)
• Fedora 23 update for libarchive, python-libarchive-c
• Fedora 24 update for libarchive
• Fedora EPEL 6 update for libarchive3
• Fedora 24 update for mingw-libarchive, mingw-xz