USN-3033-1 libarchive vulnerability

Medium

Vendor

Canonical Ubuntu, libarchive

Versions Affected

Canonical Ubuntu 14.04 LTS

Description

Hanno Böck discovered that libarchive contained multiple security issues when processing certain malformed archive files. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8916, CVE-2015-8917, CVE-2015-8919, CVE-2015-8920, CVE-2015-8921, CVE-2015-8922, CVE-2015-8923, CVE-2015-8924, CVE-2015-8925, CVE-2015-8926, CVE-2015-8928, CVE-2015-8930, CVE-2015-8931, CVE-2015-8932, CVE-2015-8933, CVE-2015-8934, CVE-2016-5844)

Marcin “Icewall” Noga discovered that libarchive contained multiple security issues when processing certain malformed archive files. A remote attacker could use this issue to cause libarchive to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-4300, CVE-2016-4302)

It was discovered that libarchive incorrectly handled memory allocation with large cpio symlinks. A remote attacker could use this issue to possibly cause libarchive to crash, resulting in a denial of service. (CVE-2016-4809)

Affected Products and Versions

_Severity is medium unless otherwise noted.
_

• Cloud Foundry BOSH stemcells 3146.x versions prior to 3146.18 AND 3232.x versions prior to 3232.16 AND other versions prior to 3262.8 are vulnerable
• All versions of Cloud Foundry cflinuxfs2 prior to v.1.71.0

Mitigation

Users of affected versions should apply the following mitigation:

• The Cloud Foundry team has released patched BOSH stemcells 3146.18 and 3232.16 with an upgraded Linux kernel that resolves the aforementioned issues. We recommend that Operators upgrade BOSH stemcell 3146.x versions to 3146.18 OR 3232.x versions to 3232.16
• The Cloud Foundry project recommends that Cloud Foundry deployments run with cflinuxfs2 v.1.71.0 or later versions

Credit

Hanno Böck and Marcin “Icewall” Noga

References

• <http://www.ubuntu.com/usn/USN-3033-1/&gt;