libarchive Access Control List link following

Summaryinfo

A vulnerability, which was classified as critical, was found in libarchive. Affected by this issue is some unknown functionality of the component Access Control List Handler. Executing a manipulation can lead to link following. This vulnerability is handled as CVE-2021-31566. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability has been found in libarchive (File Compression Software) (affected version not known) and classified as critical. This vulnerability affects some unknown functionality of the component Access Control List Handler. The manipulation with an unknown input leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.

The weakness was released 08/24/2022 as 1566. The advisory is shared for download at github.com. This vulnerability was named CVE-2021-31566 since 12/16/2021. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 239805 (TencentOS Server 3: libarchive (TSSA-2022:0019)), which helps to determine the existence of the flaw in a target environment.

Applying the patch b41daecb5ccb4c8e3b2c53fd6147109fc12c3043 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at Tenable (239805). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• File Compression Software

Name

• libarchive

License

• open-source

Website

• Product: https://github.com/libarchive/libarchive/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion