Menu
Severe flaws in widely used archive library put many projects at risk

Severe flaws in widely used archive library put many projects at risk

Input validation flaws in libarchive could lead to remote code execution

In a world where any new software project is built in large part on existing third-party code, finding and patching vulnerabilities in popular open-source libraries is vital to creating reliable and secure applications.

For example, three severe flaws in libarchive, recently found by researchers from Cisco Systems' Talos group, could affect a large number of software products.

Libarchive is an open-source library first created for FreeBSD, but since ported to all major operating systems. It provides real-time access to files compressed with a variety of algorithms, including tar, pax, cpio, ISO9660, zip, lha/lzh, rar, cab and 7-Zip.

The library is used by file and package managers included in many Linux and BSD systems, as well as by components and tools in OS X and Chrome OS. Developers can also include the library's code in their own projects, so it's hard to know how many other applications or firmware packages contain it.

The Cisco Talos researchers found an integer overflow, a buffer overflow and a heap overflow in the libarchive code that handles 7-Zip, mtree and rar files, respectively.

These are memory corruption errors that can result in arbitrary code execution and can be exploited by passing specially crafted files to applications that contain the vulnerable code.

"When vulnerabilities are discovered in a piece of software such as libarchive, many third-party programs that rely on, and bundle libarchive are affected," the Talos researchers said in a blog post Tuesday. "These are what are known as common mode failures, which enable attackers to use a single attack to compromise many different programs/systems. Users are encouraged to patch all relevant programs as quickly as possible."

The libarchive maintainers have released patches for these flaws, but it will likely take a long time for them to trickle down through all the affected projects. That's because software developers in general do a poor job of tracking vulnerabilities in the third-party code that they use and importing the available patches.

Past studies have shown that many software development firms and companies that create custom software in-house don't even have a clear picture of which third-party components and libraries have been used in their projects, not to mention their version.

The handling of complex data formats has historically led to many critical input validation vulnerabilities like the ones found by Cisco Talos in libarchive. This won't be the last time when such flaws are found in widely used libraries and components.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments