The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial of service (out-of-bounds read) or execute arbitrary code via the PartitionRef field in the Long Allocation Descriptor in a UDF file.

It was discovered that p7zip did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially crafted archive with p7zip, then p7zip could be made to crash, possibly leading to arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-27 (7-Zip: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in 7-Zip. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to open a specially crafted       archive file possibly resulting in execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Update p7zip to 16.02 and fix security issues for CVE-2016-2335, CVE-2016-2334

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

fix 7zip UDF CInArchive::ReadFileItem code execution vulnerability [boo#979823],[CVE-2016-2335]

Cisco Talos reports :

An out-of-bounds read vulnerability exists in the way 7-Zip handles Universal Disk Format (UDF) files.

Central to 7-Zip's processing of UDF files is the CInArchive::ReadFileItem method. Because volumes can have more than one partition map, their objects are kept in an object vector. To start looking for an item, this method tries to reference the proper object using the partition map's object vector and the 'PartitionRef' field from the Long Allocation Descriptor. Lack of checking whether the 'PartitionRef' field is bigger than the available amount of partition map objects causes a read out-of-bounds and can lead, in some circumstances, to arbitrary code execution.

This update for p7zip fixes one security issue.

This security issue was fixed :

  - CVE-2016-2335: UDF CInArchive::ReadFileItem code     execution vulnerability (bsc#979823)

This update was imported from the SUSE:SLE-12:Update update project.

This update for p7zip fixes the following issues :

  - add p7zip-9.20.1-CVE-2016-2335.patch to fix 7zip UDF     CInArchive::ReadFileItem code execution vulnerability     [bsc#979823], [CVE-2016-2335]

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin 'Icewall' Noga of Cisco Talos discovered an out-of-bound read vulnerability in the CInArchive::ReadFileItem method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial of service or, potentially the execution of arbitrary code with the privileges of the user running p7zip, if a specially crafted UDF file is processed.

For Debian 7 'Wheezy', these problems have been fixed in version 9.20.1~dfsg.1-4+deb7u2.

We recommend that you upgrade your p7zip packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marcin 'Icewall' Noga of Cisco Talos discovered an out-of-bound read vulnerability in the CInArchive::ReadFileItem method in p7zip, a 7zr file archiver with high compression ratio. A remote attacker can take advantage of this flaw to cause a denial-of-service or, potentially the execution of arbitrary code with the privileges of the user running p7zip, if a specially crafted UDF file is processed.

This update for p7zip fixes the following issues :

  - add p7zip-9.20.1-CVE-2016-2335.patch to fix 7zip UDF     CInArchive::ReadFileItem code execution vulnerability     [boo#979823], [CVE-2016-2335]

The version of 7-Zip installed on the remote Windows host is prior to 16.0. It is, therefore, affected by multiple vulnerabilities :

  - A heap buffer overflow condition exits in the     CHandler::ExtractZlibFile() function within file     Archive\HfsHandler.cpp due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit this by convincing a user to open a     specially crafted file, resulting in the execution of     arbitrary code. (CVE-2016-2334)

  - An out-of-bounds read error exists in the     CInArchive::ReadFileItem() function within file     Archive\Udf\UdfIn.cpp when handling Universal Disk     Format (UDF) files. An unauthenticated, remote attacker     can exploit this by convincing a user to open a     specially crafted UDF file, resulting in the execution     of arbitrary code. (CVE-2016-2335)

ID	Name	Product	Family	Severity
123074	Ubuntu 16.04 LTS : P7ZIP vulnerabilities (USN-3913-1)	Nessus	Ubuntu Local Security Checks	high
96421	GLSA-201701-27 : 7-Zip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
92669	Fedora 23 : p7zip (2016-430bc0f808)	Nessus	Fedora Local Security Checks	high
92507	openSUSE Security Update : p7zip (openSUSE-2016-890)	Nessus	SuSE Local Security Checks	high
92477	Fedora 24 : p7zip (2016-bbcb0e4eb4)	Nessus	Fedora Local Security Checks	high
92346	FreeBSD : p7zip -- out-of-bounds read vulnerability (d706a3a3-4a7c-11e6-97f7-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high
91867	openSUSE Security Update : p7zip (openSUSE-2016-771)	Nessus	SuSE Local Security Checks	high
91668	SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2016:1593-1)	Nessus	SuSE Local Security Checks	high
91574	Debian DLA-510-1 : p7zip security update	Nessus	Debian Local Security Checks	high
91549	Debian DSA-3599-1 : p7zip - security update	Nessus	Debian Local Security Checks	high
91484	openSUSE Security Update : p7zip (openSUSE-2016-673)	Nessus	SuSE Local Security Checks	high
91230	7-Zip < 16.00 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2016-2335

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high