CVE-2016-4301: Buffer Overflow
An exploitable stack based buffer overflow vulnerability exists in the mtree parsedevice functionality of libarchive. A specially crafted mtree file can cause a buffer overflow resulting in memory corruption/code execution. An attacker can send a malformed file to trigger this vulnerability.
External references:
http://www.talosintel.com/reports/TALOS-2016-0153/
Upstream fix:
https://github.com/libarchive/libarchive/commit/a550daeecf6bc689ade371349892ea17b5b97c77
Other sources
Stack-based buffer overflow in the parsedevice function in archivereadsupportformatmtree.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a crafted mtree file.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4301?
CVE-2016-4301 is classified as a high severity vulnerability due to its potential for code execution through a stack-based buffer overflow.
How do I fix CVE-2016-4301?
To fix CVE-2016-4301, update libarchive to version 3.2.1 or later.
What software versions are affected by CVE-2016-4301?
CVE-2016-4301 affects libarchive versions prior to 3.2.1.
What type of vulnerability is CVE-2016-4301?
CVE-2016-4301 is a stack-based buffer overflow vulnerability.
Can an attacker exploit CVE-2016-4301 remotely?
Yes, an attacker can exploit CVE-2016-4301 remotely by sending a specially crafted mtree file.