CVE-2018-1000880

Published: Dic 20, 2018 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2018-2057 Aliases: GSD-2018-1000880
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
MEDIUM 4,3
Source: [email protected]
Access Vector: network
Access Complexity: medium
Authentication: none
Confidentiality: none
Integrity: none
Availability: partial

Description

AI Translation Available

libarchive version commit 9693801580c0cf7c70e862d305270a16b52826a7 onwards (release v3.2.0 onwards) contains a CWE-20: Improper Input Validation vulnerability in WARC parser - libarchive/archive_read_support_format_warc.c, _warc_read() that can result in DoS - quasi-infinite run time and disk usage from tiny file. This attack appear to be exploitable via the victim must open a specially crafted WARC file.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0043
Percentile
0,6th
Updated

EPSS Score Trend (Last 90 Days)

119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Stable
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Modify Memory Read Memory Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory)
Applicable Platforms
Languages: Assembly, C, C++, Memory-Unsafe
Likelihood of Exploit: High
View CWE Details
Operating System

Ubuntu Linux by Canonical

Product Information
Vendor Canonical
Product Ubuntu Linux
Version 18.10
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ubuntu Linux by Canonical

Product Information
Vendor Canonical
Product Ubuntu Linux
Version 18.04
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Libarchive by Libarchive

Product Information
Vendor Libarchive
Product Libarchive
Version Range Affected
From 3.2.0 (inclusive)
To 3.4.0 (exclusive)
cpe:2.3:a:libarchive:libarchive:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ubuntu Linux by Canonical

Product Information
Vendor Canonical
Product Ubuntu Linux
Version 14.04
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Fedora by Fedoraproject

Product Information
Vendor Fedoraproject
Product Fedora
Version 29
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Leap by Opensuse

Product Information
Vendor Opensuse
Product Leap
Version 15.0
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System

Ubuntu Linux by Canonical

Product Information
Vendor Canonical
Product Ubuntu Linux
Version 16.04
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
http://lists.opensuse.org/opensuse-security-announce/2019-0…
Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html
https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1…
Patch Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
https://github.com/libarchive/libarchive/pull/1105
Third Party Advisory
https://github.com/libarchive/libarchive/pull/1105
https://github.com/libarchive/libarchive/pull/1105/commits/…
Patch Third Party Advisory
https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://usn.ubuntu.com/3859-1/
Third Party Advisory
https://usn.ubuntu.com/3859-1/
https://www.debian.org/security/2018/dsa-4360
Third Party Advisory
https://www.debian.org/security/2018/dsa-4360
http://www.securityfocus.com/bid/106324
Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/106324
http://lists.opensuse.org/opensuse-security-announce/2019-0…
Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00055.html
https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1…
Patch Third Party Advisory
https://bugs.launchpad.net/ubuntu/+source/libarchive/+bug/1794909
https://github.com/libarchive/libarchive/pull/1105
Third Party Advisory
https://github.com/libarchive/libarchive/pull/1105
https://github.com/libarchive/libarchive/pull/1105/commits/…
Patch Third Party Advisory
https://github.com/libarchive/libarchive/pull/1105/commits/9c84b7426660c09c18cc…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://lists.fedoraproject.org/archives/list/package-annou…
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr…
https://usn.ubuntu.com/3859-1/
Third Party Advisory
https://usn.ubuntu.com/3859-1/
https://www.debian.org/security/2018/dsa-4360
Third Party Advisory
https://www.debian.org/security/2018/dsa-4360
http://www.securityfocus.com/bid/106324
Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/106324