[Bug 206386] vendor/libarchive: directory traversal vulnerability/local denial of services

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206386

--- Comment #1 from Jason Unovitch <junovitch at freebsd.org> ---
Issue #2
Segfault/infinite loop on malformed CPIO archives.  This was patched by
delphij@ in head at 282932 [1].  It is in 10.2-RELEASE as part of stable/10 in
r283259 [2].  9.3-RELEASE does not seem to be impacted (too old?). 
10.1-RELEASE is impacted.  I've validated this in a Poudriere 10.1-RELEASE jail
that the base `tar' will spin at 100% CPU while extracting the `crash_dos.tar'
available at the upstream bug report [3].  I've also noticed Debian has
assigned a temporary bug idea on their security page [4].

It feels like while we are here we can address this in 10.1-RELEASE.

[1] https://svnweb.freebsd.org/base?view=revision&revision=282932
[2] https://svnweb.freebsd.org/base?view=revision&revision=283259
[3] https://github.com/libarchive/libarchive/issues/502
[4] https://security-tracker.debian.org/tracker/TEMP-0784213-45868B


REPLICATION CASES:
##### FreeBSD 101amd64-default 10.1-RELEASE-p27 FreeBSD 10.1-RELEASE-p27 amd64
# tar xvf crash_dos.tar
x .: Can't replace existing directory with non-directory

 3251 root             1  92    0 27804K  2612K RUN     0   1:04  64.36% bsdtar

##### FreeBSD 101i386-default 10.1-RELEASE-p27 FreeBSD 10.1-RELEASE-p27 i386
# tar xvf crash_dos.tar
x .: Can't replace existing directory with non-directory
Fatal Internal Error in libarchive: Negative skip requested.

##### Fixed port
# /usr/local/bin/bsdtar xvf crash_dos.tar                  
x .: Can't replace existing directory with non-directory
bsdtar: End of file trying to read next cpio header
bsdtar: Error exit delayed from previous errors.

-- 
You are receiving this mail because:
You are the assignee for the bug.