Insufficient UI Warning of Dangerous Operations in libarchive - #VU88217

Vulnerability details

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to a confusing error message in libarchive when attempting to modify a directory without sufficient permissions. A remote attacker can trick the victim into extracting a specially crafted archive, which can have some security impact on the system.

Affected software

Remediation

External References

• https://github.com/libarchive/libarchive/commit/f27c173d17dc807733b3a4f8c11207c3f04ff34f
• https://github.com/libarchive/libarchive/pull/2101
• https://github.com/libarchive/libarchive/pull/1609
• https://github.com/libarchive/libarchive/issues/1561

Related Security Bulletins

• Confusing error message in libarchive
• Slackware Linux update for libarchive