Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.140099
Category:F5 Local Security Checks
Title:F5 BIG-IP - libarchive vulnerability CVE-2016-5844
Summary:Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
Description:Summary:
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.

Vulnerability Impact:
For BIG-IP and VIPRION platforms that are configured to use Virtual Clustered Multiprocessing (vCMP), an authenticated administrator can upload a specially crafted ISO file and use the ISO file to create a vCMP guest virtual machine. A successful attack may cause the bsdtar to stop responding while creating the vCMP guest virtual machine.

Solution:
See the referenced vendor advisory for a solution.

CVSS Score:
4.3

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:N/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2016-5844
BugTraq ID: 91808
http://www.securityfocus.com/bid/91808
Debian Security Information: DSA-3657 (Google Search)
http://www.debian.org/security/2016/dsa-3657
https://security.gentoo.org/glsa/201701-03
https://blog.fuzzing-project.org/48-Out-of-bounds-read-and-signed-integer-overflow-in-libarchive.html
http://www.openwall.com/lists/oss-security/2016/06/23/6
http://www.openwall.com/lists/oss-security/2016/06/24/4
RedHat Security Advisories: RHSA-2016:1844
http://rhn.redhat.com/errata/RHSA-2016-1844.html
RedHat Security Advisories: RHSA-2016:1850
http://rhn.redhat.com/errata/RHSA-2016-1850.html
http://www.securitytracker.com/id/1036173
CopyrightCopyright (C) 2016 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2022 E-Soft Inc. All rights reserved.