Security Bulletin: Vulnerabilities in libarchive affect PowerKVM

Summary

PowerKVM is affected by numerous vulnerabilities in libarchive. IBM has now addressed these vulnerabilities.

Vulnerability Details

CVEID: CVE-2015-8916**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error in RAR parser. By persuading a victim to open a specially crafted RAR file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114250 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8917**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error in CAB parser. By persuading a victim to open a specially crafted CAB file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114251 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8919**
DESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow, caused by an out of bounds read error in LHA/LZH parser. By persuading a victim to open a specially-crafted LHA/LZH file, a remote authenticated attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 5.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114253 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2015-8920**
DESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in AR parser. By persuading a victim to open a specially-crafted AR file, a remote attacker could exploit this vulnerability to read a single byte of application memory.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114254 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8921**
DESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in mtree parser. By persuading a victim to open a specially-crafted mtree file, a remote attacker could exploit this vulnerability to read beyond a statically declared structure.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114255 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8922**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer dereference error. By persuading a victim to open a specially crafted 7Z file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114256 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8928**
DESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds read error in process_add_entry() function. By persuading a victim to open a specially-crafted mtree file, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114262 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8923**
DESCRIPTION:** libarchive could allow a remote attacker to obtain sensitive information, caused by an error in the ZIP parser. By persuading a victim to open a specially crafted ZIP file, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114257 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8924**
DESCRIPTION:** libarchive could allow a remote attacker to obtain sensitive information, caused by an error in the TAR parser. By persuading a victim to open a specially crafted TAR file, a remote attacker could exploit this vulnerability to obtain sensitive information.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114258 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2015-8925**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an invalid memory read in read_mtree function. By reading a specially-crafted mtree file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114259 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8926**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by a NULL pointer access error in RAR parser. By persuading a victim to open a specially crafted RAR file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114260 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8930**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an error in ISO parser. By persuading a victim to open a specially crafted ISO file, a remote attacker could exploit this vulnerability to consume all available resources.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114265 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2015-8931**
DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in archive_read_support_format_mtree.c in mtree parser. By sending a specially-crafted mtree file, an attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114266 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2015-8932**
DESCRIPTION:** libarchive is vulnerable to a denial of service, caused by an shiftleft error in compress_bidder_init in TAR parser. By persuading a victim to open a specially crafted TAR file, a remote attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 4.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114267 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-1541**
DESCRIPTION:** libarchive is vulnerable to a heap-based buffer overflow. By persuading a victim to unzip a specially-crafted zip file, a remote attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/112828 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-4300**
DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the 7zip read_SubStreamsInfo. By sending a specially-crafted 7zip file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114247 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2015-8934**
DESCRIPTION:** libarchive could allow a remote authenticated attacker to obtain sensitive information, caused by an out of bounds heap read error in RAR parser. By persuading a victim to open a specially-crafted RAR file, a remote attacker could exploit this vulnerability to read memory beyond the end of the decompression buffer.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114270 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-6250**
DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the isoent_gen_joliet_identifier() function. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/115376 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-4302**
DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by a heap overflow in the Rar RestartModel. By sending a specially-crafted Rar file, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114245 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-4809**
DESCRIPTION:** libarchive is vulnerable to a denial of service. By persuading a victim to open a specially crafted cpio archive containing a symbolic link, a remote authenticated attacker could exploit this vulnerability to cause the application to crash.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116906 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)

CVEID: CVE-2016-5418**
DESCRIPTION:** libarchive could allow a remote authenticated attacker to overwrite arbitrary files, caused by the improper handling of hardlink archive entries of non-zero size. An attacker could exploit this vulnerability to overwrite arbitrary files with arbitrary data from the archive.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116907 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-5844**
DESCRIPTION:** libarchive could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in choose_volume(). By persuading a victim to open a specially-crafted ISO file, an attacker could overflow a buffer and execute arbitrary code on the system.
CVSS Base Score: 6.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114496 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-7166**
DESCRIPTION:** libarchive is vulnerable to a denial of service. By persuading a victim to open a specially crafted gzip file, a remote authenticated attacker could exploit this vulnerability to allocate memory without limit and cause the application to crash.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116908 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)

Affected Products and Versions

PowerKVM 3.1 only

Remediation/Fixes

ustomers can update PowerKVM systems by using “yum update”.

Fix images are made available via Fix Central. For version 3.1, see https://ibm.biz/BdHggw. This issue is addressed as of 3.1.0.2 update 3 or later.

Workarounds and Mitigations

None