http://advisories.mageia.org/MGASA-2015-0106.html

openSUSE-SU-2015:0568

DSA-3180

MDVSA-2015:157

[oss-security] 20150108 Directory traversals in cpio and friends?

[oss-security] 20150116 CVE Request: libarchive -- directory traversal in bsdcpio

1035996

USN-2549-1

https://github.com/libarchive/libarchive/commit/59357157706d47c365b2227739e17daba3607526

https://github.com/libarchive/libarchive/pull/110

https://groups.google.com/forum/#!msg/libarchive-discuss/dN9y1VvE1Qk/Z9uerigjQn0J

GLSA-201701-03

FreeBSD-SA-16:22

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Absolute path traversal vulnerability in bsdcpio in     libarchive 3.1.2 and earlier allows remote attackers to     write to arbitrary files via a full pathname in an     archive.(CVE-2015-2304)

  - An out-of-bounds read flaw exists in parse_file_info in     archive_read_support_format_iso9660.c in libarchive     3.3.2 when extracting a specially crafted iso9660 iso     file, related to     archive_read_format_iso9660_read_header.(CVE-2017-14501     )

  - archive_read_format_rar_read_data in     archive_read_support_format_rar.c in libarchive before     3.4.0 has a use-after-free in a certain ARCHIVE_FAILED     situation, related to     Ppmd7_DecodeSymbol.(CVE-2019-18408)

  - bsdcpio in libarchive before 3.2.0 allows remote     attackers to cause a denial of service (invalid read     and crash) via crafted cpio file.(CVE-2015-8915)

  - libarchive 3.3.2 allows remote attackers to cause a     denial of service (xml_data heap-based buffer over-read     and application crash) via a crafted xar archive,     related to the mishandling of empty strings in the     atol8 function in     archive_read_support_format_xar.c.(CVE-2017-14166)

  - libarchive 3.3.2 suffers from an out-of-bounds read     within lha_read_data_none() in     archive_read_support_format_lha.c when extracting a     specially crafted lha archive, related to     lha_crc16.(CVE-2017-14503)

  - The archive_le32dec function in archive_endian.h in     libarchive 3.2.2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted file.(CVE-2016-10349)

  - The archive_read_format_cab_read_header function in     archive_read_support_format_cab.c in libarchive 3.2.2     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted file.(CVE-2016-10350)

  - The archive_wstring_append_from_mbs function in     archive_string.c in libarchive 3.2.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     archive file.(CVE-2016-10209)

  - The mtree bidder in libarchive 3.2.1 does not keep     track of line sizes when extending the read-ahead,     which allows remote attackers to cause a denial of     service (crash) via a crafted file, which triggers an     invalid read in the (1) detect_form or (2) bid_entry     function in     libarchive/archive_read_support_format_mtree.c.(CVE-201     6-8688)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - archive_read_format_rar_read_data in     archive_read_support_format_rar.c in libarchive before     3.4.0 has a use-after-free in a certain ARCHIVE_FAILED     situation, related to     Ppmd7_DecodeSymbol.(CVE-2019-18408)

  - Absolute path traversal vulnerability in bsdcpio in     libarchive 3.1.2 and earlier allows remote attackers to     write to arbitrary files via a full pathname in an     archive.(CVE-2015-2304)

  - Integer overflow in the archive_read_format_tar_skip     function in archive_read_support_format_tar.c in     libarchive before 3.2.0 allows remote attackers to     cause a denial of service (crash) via a crafted tar     file.(CVE-2015-8933)

  - The archive_wstring_append_from_mbs function in     archive_string.c in libarchive 3.2.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     archive file.(CVE-2016-10209)

  - An error in the lha_read_file_header_1() function     (archive_read_support_format_lha.c) in libarchive 3.2.2     allows remote attackers to trigger an out-of-bounds     read memory access and subsequently cause a crash via a     specially crafted archive.(CVE-2017-5601)

  - read_header in archive_read_support_format_rar.c in     libarchive 3.3.2 suffers from an off-by-one error for     UTF-16 names in RAR archives, leading to an     out-of-bounds read in     archive_read_format_rar_read_header.(CVE-2017-14502)

  - The read_Header function in     archive_read_support_format_7zip.c in libarchive 3.2.1     allows remote attackers to cause a denial of service     (out-of-bounds read) via multiple EmptyStream     attributes in a header in a 7zip     archive.(CVE-2016-8689)

  - Stack-based buffer overflow in the safe_fprintf     function in tar/util.c in libarchive 3.2.1 allows     remote attackers to cause a denial of service via a     crafted non-printable multibyte character in a     filename.(CVE-2016-8687)

  - libarchive 3.3.2 suffers from an out-of-bounds read     within lha_read_data_none() in     archive_read_support_format_lha.c when extracting a     specially crafted lha archive, related to     lha_crc16.(CVE-2017-14503)

  - The mtree bidder in libarchive 3.2.1 does not keep     track of line sizes when extending the read-ahead,     which allows remote attackers to cause a denial of     service (crash) via a crafted file, which triggers an     invalid read in the (1) detect_form or (2) bid_entry     function in     libarchive/archive_read_support_format_mtree.c.(CVE-201     6-8688)

  - The archive_le32dec function in archive_endian.h in     libarchive 3.2.2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted file.(CVE-2016-10349)

  - The archive_read_format_cab_read_header function in     archive_read_support_format_cab.c in libarchive 3.2.2     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted file.(CVE-2016-10350)

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-416: Use After     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c that can     result in Crash/DoS - it is unknown if RCE is possible.
    This attack appear to be exploitable via the victim     must open a specially crafted RAR     archive.(CVE-2018-1000878)

  - libarchive version commit     416694915449219d505531b1096384f3237dd6cc onwards     (release v3.1.0 onwards) contains a CWE-415: Double     Free vulnerability in RAR decoder -     libarchive/archive_read_support_format_rar.c,     parse_codes(), realloc(rar->lzss.window, new_size) with     new_size = 0 that can result in Crash/DoS. This attack     appear to be exploitable via the victim must open a     specially crafted RAR archive.(CVE-2018-1000877)

  - bsdcpio in libarchive before 3.2.0 allows remote     attackers to cause a denial of service (invalid read     and crash) via crafted cpio file.(CVE-2015-8915)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The read_Header function in     archive_read_support_format_7zip.c in libarchive 3.2.1     allows remote attackers to cause a denial of service     (out-of-bounds read) via multiple EmptyStream     attributes in a header in a 7zip     archive.(CVE-2016-8689)

  - Stack-based buffer overflow in the safe_fprintf     function in tar/util.c in libarchive 3.2.1 allows     remote attackers to cause a denial of service via a     crafted non-printable multibyte character in a     filename.(CVE-2016-8687)

  - libarchive 3.3.2 suffers from an out-of-bounds read     within lha_read_data_none() in     archive_read_support_format_lha.c when extracting a     specially crafted lha archive, related to     lha_crc16.(CVE-2017-14503)

  - An out-of-bounds read flaw exists in parse_file_info in     archive_read_support_format_iso9660.c in libarchive     3.3.2 when extracting a specially crafted iso9660 iso     file, related to     archive_read_format_iso9660_read_header.(CVE-2017-14501     )

  - libarchive 3.3.2 allows remote attackers to cause a     denial of service (xml_data heap-based buffer over-read     and application crash) via a crafted xar archive,     related to the mishandling of empty strings in the     atol8 function in     archive_read_support_format_xar.c.(CVE-2017-14166)

  - The mtree bidder in libarchive 3.2.1 does not keep     track of line sizes when extending the read-ahead,     which allows remote attackers to cause a denial of     service (crash) via a crafted file, which triggers an     invalid read in the (1) detect_form or (2) bid_entry     function in     libarchive/archive_read_support_format_mtree.c.(CVE-201     6-8688)

  - The archive_read_format_cab_read_header function in     archive_read_support_format_cab.c in libarchive 3.2.2     allows remote attackers to cause a denial of service     (heap-based buffer over-read and application crash) via     a crafted file.(CVE-2016-10350)

  - The archive_le32dec function in archive_endian.h in     libarchive 3.2.2 allows remote attackers to cause a     denial of service (heap-based buffer over-read and     application crash) via a crafted file.(CVE-2016-10349)

  - The archive_wstring_append_from_mbs function in     archive_string.c in libarchive 3.2.2 allows remote     attackers to cause a denial of service (NULL pointer     dereference and application crash) via a crafted     archive file.(CVE-2016-10209)

  - Integer overflow in the archive_read_format_tar_skip     function in archive_read_support_format_tar.c in     libarchive before 3.2.0 allows remote attackers to     cause a denial of service (crash) via a crafted tar     file.(CVE-2015-8933)

  - bsdcpio in libarchive before 3.2.0 allows remote     attackers to cause a denial of service (invalid read     and crash) via crafted cpio file.(CVE-2015-8915)

  - Absolute path traversal vulnerability in bsdcpio in     libarchive 3.1.2 and earlier allows remote attackers to     write to arbitrary files via a full pathname in an     archive.(CVE-2015-2304)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-03 (libarchive: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libarchive. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive file possibly resulting in the execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for libarchive fixes several issues.

These security issues were fixed :

  - CVE-2016-8687: Buffer overflow when printing a filename     (bsc#1005070).

  - CVE-2016-8689: Heap overflow when reading corrupted 7Zip     files (bsc#1005072).

  - CVE-2016-8688: Use after free because of incorrect     calculation in next_line (bsc#1005076).

  - CVE-2016-5844: Integer overflow in the ISO parser in     libarchive allowed remote attackers to cause a denial of     service (application crash) via a crafted ISO file     (bsc#986566).

  - CVE-2016-6250: Integer overflow in the ISO9660 writer in     libarchive allowed remote attackers to cause a denial of     service (application crash) or execute arbitrary code     via vectors related to verifying filename lengths when     writing an ISO9660 archive, which trigger a buffer     overflow (bsc#989980).

  - CVE-2016-5418: The sandboxing code in libarchive     mishandled hardlink archive entries of non-zero data     size, which might allowed remote attackers to write to     arbitrary files via a crafted archive file (bsc#998677).

This update was imported from the SUSE:SLE-12:Update update project.

This update for libarchive fixes several issues. These security issues were fixed :

  - CVE-2016-8687: Buffer overflow when printing a filename     (bsc#1005070).

  - CVE-2016-8689: Heap overflow when reading corrupted 7Zip     files (bsc#1005072).

  - CVE-2016-8688: Use after free because of incorrect     calculation in next_line (bsc#1005076).

  - CVE-2016-5844: Integer overflow in the ISO parser in     libarchive allowed remote attackers to cause a denial of     service (application crash) via a crafted ISO file     (bsc#986566).

  - CVE-2016-6250: Integer overflow in the ISO9660 writer in     libarchive allowed remote attackers to cause a denial of     service (application crash) or execute arbitrary code     via vectors related to verifying filename lengths when     writing an ISO9660 archive, which trigger a buffer     overflow (bsc#989980).

  - CVE-2016-5418: The sandboxing code in libarchive     mishandled hardlink archive entries of non-zero data     size, which might allowed remote attackers to write to     arbitrary files via a crafted archive file (bsc#998677).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bsdtar was updated to fix seven security issues. These security issues were fixed :

  - CVE-2015-8929: Memory leak in tar parser (bsc#985669).

  - CVE-2016-4809: Memory allocate error with symbolic links     in cpio archives (bsc#984990).

  - CVE-2015-8920: Stack out of bounds read in ar parser     (bsc#985675).

  - CVE-2015-8921: Global out of bounds read in mtree parser     (bsc#985682).

  - CVE-2015-8924: Heap buffer read overflow in tar     (bsc#985609).

  - CVE-2015-8918: Overlapping memcpy in CAB parser     (bsc#985698).

  - CVE-2015-2304: Reject absolute paths in input mode of     bsdcpio exactly when '..' is rejected (bsc#920870).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of Splunk Enterprise hosted on the remote web server is 5.0.x, 6.0.x prior to 6.0.12, 6.1.x prior to 6.1.11, 6.2.x prior to 6.2.11, 6.3.x prior to 6.3.6, or 6.4.x prior to 6.4.2; or else it is Splunk Light version 6.4.x prior to 6.4.2. It is, therefore, affected by the following vulnerabilities :

  - An integer signedness error exists in libarchive in the     archive_write_zip_data() function within file     archive_write_set_format_zip.c due to improper     conversion between unsigned and signed integer types     when running on 64-bit CPUs. An unauthenticated, remote     attacker can exploit this to cause a buffer overflow,     resulting in a denial of service condition.
    (CVE-2013-0211)

  - A path traversal vulnerability exists in libarchive in     the bsdcpio() function within file in cpio/cpio.c due to     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit this, via     a specially crafted path in an archive, to write to     arbitrary files. (CVE-2015-2304)

  - A heap-based buffer overflow condition exists in     libarchive in the zip_read_mac_metadata() function     within file archive_read_support_format_zip.c due to     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit this, via     specially crafted entry-size values in a ZIP archive, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-1541)

  - Multiple flaws exist in the OpenSSL library in the     aesni_cbc_hmac_sha1_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha1.c and the     aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - An unspecified cross-site scripting (XSS) vulnerability     exists due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in the user's browser session.

  - An unspecified cross-site redirection vulnerability     exists due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this, by convincing a user to visit a specially crafted     web link, to redirect the browser to an arbitrary     website of the attacker's own choosing.

Note that Splunk Enterprise 5.0.x will not be patched for OpenSSL issues, and it is recommended you upgrade to the latest version.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MITRE reports :

Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.

Absolute path traversal vulnerability in bsdcpio in libarchive 3.1.2 and earlier allows remote attackers to write to arbitrary files via a full pathname in an archive.

Libarchive issue tracker reports :

Using a crafted tar file bsdtar can perform an out-of-bounds memory read which will lead to a SEGFAULT. The issue exists when the executable skips data in the archive. The amount of data to skip is defined in byte offset [16-19] If ASLR is disabled, the issue can lead to an infinite loop.

libarchive was updated to fix a directory traversal in the bsdcpio tool, which allowed attackers supplying crafted archives to overwrite files. (CVE-2015-2304)

Also, a integer overflow was fixed that could also overflow buffers.
(CVE-2013-0211)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libarchive packages fix security vulnerability :

Alexander Cherepanov discovered that bsdcpio, an implementation of the cpio program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths (CVE-2015-2304).

It was discovered that the libarchive bsdcpio utility extracted absolute paths by default without using the --insecure flag, contrary to expectations. If a user or automated system were tricked into extracting cpio archives containing absolute paths, a remote attacker may be able to write to arbitrary files. (CVE-2015-2304)

Fabian Yamaguchi discovered that libarchive incorrectly handled certain type conversions. A remote attacker could possibly use this issue to cause libarchive to crash, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS. (CVE-2013-0211).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libarchive was updated to fix a directory traversal in the bsdcpio tool, which allowed attackers supplying crafted archives to overwrite files. (CVE-2015-2304)

Also, a integer overflow was fixed that could also overflow buffers.
(CVE-2013-0211)

Alexander Cherepanov discovered that bsdcpio, an implementation of the'cpio' program part of the libarchive project, is susceptible to a directory traversal vulnerability via absolute paths.

ID	Name	Product	Family	Severity
132139	EulerOS 2.0 SP3 : libarchive (EulerOS-SA-2019-2604)	Nessus	Huawei Local Security Checks	medium
131871	EulerOS 2.0 SP2 : libarchive (EulerOS-SA-2019-2379)	Nessus	Huawei Local Security Checks	medium
130664	EulerOS 2.0 SP5 : libarchive (EulerOS-SA-2019-2202)	Nessus	Huawei Local Security Checks	medium
96234	GLSA-201701-03 : libarchive: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
95559	openSUSE Security Update : libarchive (openSUSE-2016-1405)	Nessus	SuSE Local Security Checks	high
95558	openSUSE Security Update : libarchive (openSUSE-2016-1404)	Nessus	SuSE Local Security Checks	high
95367	SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2016:2911-1)	Nessus	SuSE Local Security Checks	high
93187	SUSE SLES11 Security Update : bsdtar (SUSE-SU-2016:1939-1)	Nessus	SuSE Local Security Checks	medium
92790	Splunk Enterprise < 5.0.16 / 6.0.12 / 6.1.11 / 6.2.11 / 6.3.6 / 6.4.2 or Splunk Light < 6.4.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium
87984	FreeBSD : libarchive -- multiple vulnerabilities (7c63775e-be31-11e5-b5fe-002590263bf5)	Nessus	FreeBSD Local Security Checks	medium
83710	SUSE SLED12 / SLES12 Security Update : libarchive (SUSE-SU-2015:0667-1)	Nessus	SuSE Local Security Checks	medium
82410	Mandriva Linux Security Advisory : libarchive (MDVSA-2015:157)	Nessus	Mandriva Local Security Checks	medium
82268	Ubuntu 12.04 LTS / 14.04 LTS / 14.10 : libarchive vulnerabilities (USN-2549-1)	Nessus	Ubuntu Local Security Checks	medium
82012	openSUSE Security Update : libarchive (openSUSE-2015-248)	Nessus	SuSE Local Security Checks	medium
81654	Debian DSA-3180-1 : libarchive - security update	Nessus	Debian Local Security Checks	medium

CVE-2015-2304

Description

References

Details

Risk Information

CVSS v2.0

Vulnerable Software

Configuration 1

Configuration 2

Tenable Plugins