Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The remote NewStart CGSL host, running version MAIN 6.02, has bzip2 packages installed that are affected by a vulnerability:

  - Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of     service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
    (CVE-2016-3189)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2019:14122-1 advisory.

  - Use-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of     service (crash) via a crafted bzip2 file, related to block ends set to before the start of the block.
    (CVE-2016-3189)

  - BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many     selectors. (CVE-2019-12900)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Use-after-free vulnerability in bzip2recover in bzip2     1.0.6 allows remote attackers to cause a denial of     service (crash) via a crafted bzip2 file, related to     block ends set to before the start of the     block.(CVE-2016-3189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The decompressor used in bzip2 contains a bug which can lead to an out-of-bounds write when processing a specially crafted bzip2(1) file.

bzip2recover contains a heap use-after-free bug which can be triggered when processing a specially crafted bzip2(1) file. Impact : An attacker who can cause maliciously crafted input to be processed may trigger either of these bugs. The bzip2recover bug may cause a crash, permitting a denial-of-service. The bzip2 decompressor bug could potentially be exploited to execute arbitrary code.

Note that some utilities, including the tar(1) archiver and the bspatch(1) binary patching utility (used in portsnap(8) and freebsd-update(8)) decompress bzip2(1)-compressed data internally;
system administrators should assume that their systems will at some point decompress bzip2(1)-compressed data even if they never explicitly invoke the bunzip2(1) utility.

This update for bzip2 fixes the following issues :

Security issue fixed :

CVE-2019-12900: Fixed an out-of-bounds write in decompress.c with many selectors (bsc#1139083).

CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New bzip2 packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

This update for bzip2 fixes the following issues :

Security issue fixed :

CVE-2016-3189: Fixed a use-after-free in bzip2recover (bsc#985657).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

bzip2 developers reports :

CVE-2016-3189 - Fix use-after-free in bzip2recover (Jakub Martisko)

CVE-2019-12900 - Detect out-of-range nSelectors in corrupted files (Albert Astals Cid). Found through fuzzing karchive.

Aladdin Mubaied discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-3189)

It was discovered that bzip2 incorrectly handled certain files. An attacker could possibly use this issue to execute arbitrary code.
(CVE-2019-12900).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for bzip2 fixes the following issues :

Security issue fixed :

  - CVE-2016-3189: Fixed a use-after-free in bzip2recover     (bsc#985657).

This update was imported from the SUSE:SLE-15:Update update project.

According to the version of the bzip2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A use-after-free flaw was found in bzip2recover,     leading to a null pointer dereference, or a write to a     closed file descriptor. An attacker could use this flaw     by sending a specially crafted bzip2 file to recover     and force the program to crash.i1/4^CVE-2016-3189i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the bzip2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A use-after-free flaw was found in bzip2recover,     leading to a null pointer dereference, or a write to a     closed file descriptor. An attacker could use this flaw     by sending a specially crafted bzip2 file to recover     and force the program to crash.(CVE-2016-3189)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201708-08 (bzip2: Denial of Service)

    A use-after-free flaw was found in bzip2recover, leading to a null       pointer dereference, or a write to a closed file descriptor. Please       review the CVE identifier referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       bzip2 archive using bzip2recover, possibly resulting in a Denial of       Service condition.
  Workaround :

    There is no known workaround at this time.

CVE-2016-3189 bzip2: heap use after free in bzip2recover

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
154539	NewStart CGSL MAIN 6.02 : bzip2 Vulnerability (NS-SA-2021-0118)	Nessus	NewStart CGSL Local Security Checks	medium
150585	SUSE SLES11 Security Update : bzip2 (SUSE-SU-2019:14122-1)	Nessus	SuSE Local Security Checks	critical
132277	EulerOS 2.0 SP3 : bzip2 (EulerOS-SA-2019-2560)	Nessus	Huawei Local Security Checks	medium
131903	EulerOS 2.0 SP2 : bzip2 (EulerOS-SA-2019-2411)	Nessus	Huawei Local Security Checks	medium
130240	FreeBSD : FreeBSD -- Multiple vulnerabilities in bzip2 (3c7edc7a-f680-11e9-a87f-a4badb2f4699)	Nessus	FreeBSD Local Security Checks	high
126985	SUSE SLED12 / SLES12 Security Update : bzip2 (SUSE-SU-2019:1955-1)	Nessus	SuSE Local Security Checks	critical
126685	Slackware 14.0 / 14.1 / 14.2 / current : bzip2 (SSA:2019-195-01)	Nessus	Slackware Local Security Checks	critical
126493	SUSE SLED15 / SLES15 Security Update : bzip2 (SUSE-SU-2019:1206-2)	Nessus	SuSE Local Security Checks	medium
126364	FreeBSD : bzip2 -- multiple issues (4b6cb45d-881e-447a-a4e0-c97a954ea758)	Nessus	FreeBSD Local Security Checks	critical
126305	Ubuntu 16.04 LTS / 18.04 LTS : bzip2 vulnerabilities (USN-4038-1)	Nessus	Ubuntu Local Security Checks	critical
125350	openSUSE Security Update : bzip2 (openSUSE-2019-1435)	Nessus	SuSE Local Security Checks	medium
125211	openSUSE Security Update : bzip2 (openSUSE-2019-1398)	Nessus	SuSE Local Security Checks	medium
124854	SUSE SLED15 / SLES15 Security Update : bzip2 (SUSE-SU-2019:1206-1)	Nessus	SuSE Local Security Checks	medium
123857	EulerOS Virtualization 2.5.3 : bzip2 (EulerOS-SA-2019-1171)	Nessus	Huawei Local Security Checks	medium
122167	EulerOS 2.0 SP5 : bzip2 (EulerOS-SA-2019-1020)	Nessus	Huawei Local Security Checks	medium
102620	GLSA-201708-08 : bzip2: Denial of Service	Nessus	Gentoo Local Security Checks	medium
96291	Fedora 24 : bzip2 (2016-fd44637912)	Nessus	Fedora Local Security Checks	medium
96219	Fedora 25 : bzip2 (2016-e7b46c92ae)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2016-3189

medium

Tenable Plugins

critical

medium

critical

medium

medium

high

critical

critical

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium