A vulnerability discovered in multi-format archive and compression library libarchive could lead to arbitrary code execution.
The compression library is mostly known for being used in software to copy files to and from archives, to create archives, and compress and expand data.
Because of its capabilities, it has been adopted in a broad range of package managers, archiving tools, file browsers, and operating systems.
The newly discovered issue, a use-after-free vulnerability, could be abused to cause a denial of service condition, and potentially execute arbitrary code on a vulnerable system. For that, an attacker would have to create a malformed archive to trigger the security flaw during processing.
Tracked as CVE-2019-18408, the vulnerability was discovered by Google security researchers via OSS-Fuzz, and has been already patched in version 3.4.0 of the archive.
“archive_read_format_rar_read_data in archive_read_support_format_rar.c in libarchive before 3.4.0 has a use-after-free in a certain ARCHIVE_FAILED situation, related to Ppmd7_DecodeSymbol,” the bug’s description in the Debian bug tracker reads.
In addition to Debian, the vulnerability also impacts Ubuntu, Arch Linux, FreeBSD, and NetBSD. Libarchive 3.3.3 is also present in the OpenBSD package repository, although not in the base install.
macOS and Windows, which also contain the library (since 2009 and 2017, respectively), are not impacted.
The issue has been addressed in Debian oldstable distribution (stretch) version 3.2.2-2+deb9u2 and stable distribution (buster) version 3.3.3-4+deb10u1. Ubuntu 19.04, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, Ubuntu 14.04 ESM also contain the fix.
Other Linux distributions have also rolled out updates to keep users protected from the bug.
Related: Remote Code Execution Flaws Impact Aspose APIs
More from Ionut Arghire
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- 820k Impacted by Data Breach at Zacks Investment Research
- US Government Agencies Warn of Malicious Use of Remote Management Software
- Chinese Hackers Adopting Open Source ‘SparkRAT’ Tool
- CISA Provides Resources for Securing K-12 Education System
Latest News
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Cyberattacks Target Websites of German Airports, Admin
- US Infiltrates Big Ransomware Gang: ‘We Hacked the Hackers’
