Integer overflow in isoent_gen_joliet_identifier() in libarchive libarchive

1) Integer overflow in isoent_gen_joliet_identifier()

EUVDB-ID: #VU215

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2016-6250

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error in libarchive. A remote unauthenticated attacker can cause integer overflow by creating a file with a specially crafted filename that archived as an ISO9660 archive by the target application using libarchive.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install the latest version: (3.2.1).

Vulnerable software versions

libarchive: 2.6.992 - 3.2.0

Oracle Linux: 7

CPE2.3

• cpe:2.3:a:libarchive:libarchive:2.6.992:*:*:*:*:*:*:*
• cpe:2.3:a:libarchive:libarchive:2.7.0:*:*:*:*:*:*:*
• cpe:2.3:a:libarchive:libarchive:2.7.1:*:*:*:*:*:*:*
• cpe:2.3:o:oracle:oracle_linux:7:*:*:*:*:*:*:*

External links

https://github.com/libarchive/libarchive/issues/711
https://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to open a a specially crafted archive.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.