archive_read_support_format_tar.c in libarchive before 2.2.4 allows user-assisted remote attackers to cause a denial of service (infinite loop) via (1) an end-of-file condition within a pax extension header or (2) a malformed pax extension header in an (a) PAX or a (b) TAR archive.

Several local/remote vulnerabilities have been discovered in libarchive1, a single library to read/write tar, cpio, pax, zip, iso9660 archives. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3641     It was discovered that libarchive1 would miscompute the     length of a buffer resulting in a buffer overflow if yet     another type of corruption occurred in a pax extension     header.

  - CVE-2007-3644     It was discovered that if an archive prematurely ended     within a pax extension header the libarchive1 library     could enter an infinite loop.

  - CVE-2007-3645     If an archive prematurely ended within a tar header,     immediately following a pax extension header,     libarchive1 could dereference a NULL pointer.

Specially crafted tar-archives could cause programs based on libarchive to crash, to run into an enless loop or potentially to even execute arbitrary code (CVE-2007-3641, CVE-2007-3644, CVE-2007-3645).

The remote host is affected by the vulnerability described in GLSA-200708-03 (libarchive (formerly named as bsdtar): Multiple PaX Extension Header Vulnerabilities)

    CPNI, CERT-FI, Tim Kientzle, and Colin Percival reported a buffer     overflow (CVE-2007-3641), an infinite loop (CVE-2007-3644), and a NULL     pointer dereference (CVE-2007-3645) within the processing of archives     having corrupted PaX extension headers.
  Impact :

    An attacker can trick a user or automated system to process an archive     with malformed PaX extension headers into execute arbitrary code, crash     an application using the library, or cause a high CPU load.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
29902	Debian DSA-1455-1 : libarchive - denial of service	Nessus	Debian Local Security Checks	high
27316	openSUSE 10 Security Update : libarchive (libarchive-3982)	Nessus	SuSE Local Security Checks	high
25868	GLSA-200708-03 : libarchive (formerly named as bsdtar): Multiple PaX Extension Header Vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2007-3644

medium

Tenable Plugins

high

high

high