Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and     p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a     denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
    (CVE-2018-5996)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of p7zip installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2018-5996 advisory.

  - Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and     p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a     denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
    (CVE-2018-5996)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and
    p7zip can lead to multiple memory corruptions within the PPMd code, allows remote attackers to cause a
    denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.
    (CVE-2018-5996)

  - Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of
    uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or
    execute arbitrary code via a crafted RAR archive. (CVE-2018-10115)

The version of 7-Zip installed on the remote Windows host is prior to 18.0. It is, therefore, affected by multiple vulnerabilities.

This update for p7zip fixes the following security issues :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

This update was imported from the SUSE:SLE-12:Update update project.

This update for p7zip fixes the following issues: Security issues fixed :

  - CVE-2016-1372: Fixed multiple vulnerabilities when     processing crafted 7z files (bsc#984650)

  - CVE-2017-17969: Fixed a heap-based buffer overflow in a     shrink decoder (bsc#1077725)

  - CVE-2018-5996: Fixed memory corruption in RAR     decompression. The complete RAR decoder was removed as     it also has license issues (bsc#1077724 bsc#1077978)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

Insufficient exception handling in the method NCompress::NRar3::CDecoder::Code of 7-Zip before 18.00 and p7zip can lead to multiple memory corruptions within the PPMd code, alows remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive.

ID	Name	Product	Family	Severity
255147	Linux Distros Unpatched Vulnerability : CVE-2018-5996	Nessus	Misc.	high
201709	CBL Mariner 2.0 Security Update: p7zip (CVE-2018-5996)	Nessus	MarinerOS Local Security Checks	high
406201	Alpine: p7zip: security update to 16.02-r3	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406201	Alpine: p7zip: security update to 16.02-r3	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400697	Alpine: p7zip: security update to 16.02-r2 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400697	Alpine: p7zip: security update to 16.02-r2 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
109800	7-Zip < 18.00 Multiple Vulnerabilities	Nessus	Windows	high
106920	openSUSE Security Update : p7zip (openSUSE-2018-188)	Nessus	SuSE Local Security Checks	high
106897	SUSE SLED12 / SLES12 Security Update : p7zip (SUSE-SU-2018:0464-1)	Nessus	SuSE Local Security Checks	high
106736	FreeBSD : p7zip-codec-rar -- insufficient error handling (7a2e0063-0e4e-11e8-94c0-5453ed2e2b49)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-5996

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high