Every now and again, a security vulnerability is discovered in a program with little fanfare, despite the fact that it’s buried in plain sight inside software lots of people depend on. A good example is libarchive, which has a flaw discovered by Google researchers in May using the ClusterFuzz and OSSFuzz automated ‘fuzzing’ tools and fixed by libarchive’s maintainers on 12 June in version 3.4.0.
Libarchive, for those not familiar with it, is a compression and archiving library originally developed for FreeBSD that has achieved widespread popularity because it functions like a do-everything compressed archive handler supporting file and compression formats including ZIP, gzip, tar, uuencode, 7z, Microsoft CAB, ISO9660 (CD images) and many more. It’s also used by Debian, Ubuntu, Gentoo, Arch Linux, and the Chromebook Chrome OS, as well as tools such as the Samba Linux-Windows interoperability suite, all of which are now receiving the June patch. It’s even part of Apple’s macOS and Microsoft’s Windows 10, although neither are thought to be affected by the vulnerability.
The bug is identified as
CVE-2019-18408, a high-priority ‘use-after-free’ bug when dealing with a failed archive. No real-world exploits have been detected but if one existed, it would attempt to use a malicious archive to induce a denial-of-service state or arbitrary code execution. Obviously, this sets a low bar for an attacker which earns it a CVSS rating of 7.5. However, the real nuisance of this one is simply the inconvenient volume of software using it, which must now be patched.
![[correlate]](/data/avatars/s/79/79653.jpg?1556985072){kind=avatar}
