Test ID:	1.3.6.1.4.1.25623.1.0.58443
Category:	FreeBSD Local Security Checks
Title:	FreeBSD Security Advisory (FreeBSD-SA-07:05.libarchive.asc)
Summary:	The remote host is missing an update to the system; as announced in the referenced advisory FreeBSD-SA-07:05.libarchive.asc
Description:	Summary: The remote host is missing an update to the system as announced in the referenced advisory FreeBSD-SA-07:05.libarchive.asc Vulnerability Insight: The libarchive library provides a flexible interface for reading and writing streaming archive files such as tar and cpio, and has been the basis for FreeBSD's implementation of the tar(1) utility since FreeBSD 5.3. Several problems have been found in the code used to parse the tar and pax interchange formats. These include entering an infinite loop if an archive prematurely ends within a pax extension header or if certain types of corruption occur in pax extension headers [CVE-2007-3644]. Dereferencing a NULL pointer if an archive prematurely ends within a tar header immediately following a pax extension header or if certain other types of corruption occur in pax extension headers [CVE-2007-3645]. Miscomputing the length of a buffer resulting in a buffer overflow if yet another type of corruption occurs in a pax extension header [CVE-2007-3641]. Solution: Upgrade your system to the appropriate stable release or security branch dated after the correction date. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-3641 BugTraq ID: 24885 http://www.securityfocus.com/bid/24885 Debian Security Information: DSA-1455 (Google Search) http://www.debian.org/security/2008/dsa-1455 FreeBSD Security Advisory: FreeBSD-SA-07:05.libarchive http://security.freebsd.org/advisories/FreeBSD-SA-07:05.libarchive.asc http://security.gentoo.org/glsa/glsa-200708-03.xml http://security.freebsd.org/patches/SA-07:05/libarchive.patch http://osvdb.org/38092 http://www.securitytracker.com/id?1018379 http://secunia.com/advisories/26050 http://secunia.com/advisories/26062 http://secunia.com/advisories/26355 http://secunia.com/advisories/28377 SuSE Security Announcement: SUSE-SR:2007:015 (Google Search) http://www.novell.com/linux/security/advisories/2007_15_sr.html http://www.vupen.com/english/advisories/2007/2521 XForce ISS Database: freebsd-libarchive-pax-bo(35405) https://exchange.xforce.ibmcloud.com/vulnerabilities/35405
Copyright	Copyright (C) 2008 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.