Cloudanix VulnDB

CVE-2015-8916

Medium · 6.5

CVSS

6.5

EPSS

3.2%

Published

Sep 20, 2016

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a common file-extraction tool lets attackers send a specially made RAR file that crashes the program, stopping legitimate work until it is restarted.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

bsdtar returns success without populating the archive entry structure when encountering a split-file header in a multivolume RAR archive, resulting in a subsequent NULL pointer dereference and process crash.

Why it matters to the business

Attackers can remotely crash archive extraction or listing tools on systems that use vulnerable libarchive, causing denial of service for backup, packaging, or file-handling workflows with no data loss or code execution.

How an attack unfolds

An attacker creates a specially crafted multivolume RAR containing a split-file header entry, then delivers the archive to a target user or automated process that invokes bsdtar or libarchive APIs to list or extract it; the missing entry population triggers the NULL dereference and immediate crash.

How to fix it

Upgrade libarchive to version 3.2.0 or later on all affected systems; rebuild and redeploy any statically linked applications or packages that embed the vulnerable library; replace any custom bsdtar wrappers with the patched binary.

How to confirm the fix worked

Confirm installed libarchive version is 3.2.0 or newer via package manager or bsdtar --version; attempt extraction of a test multivolume RAR containing a split file and verify the process completes without crash.

Typical attack path

  1. Craft RAR archive with split-file multivolume header that triggers the success-without-entry code path
  2. Deliver archive via email, download, or shared storage to a system running vulnerable bsdtar or libarchive
  3. Victim or automated process invokes bsdtar -t, bsdtar -x, or equivalent API on the archive
  4. Library returns success without populating entry, leading to NULL dereference and crash

How to detect it

Review system and application logs for abrupt bsdtar or libarchive process terminations with segmentation faults or NULL pointer errors while processing RAR archives; correlate with file-access timestamps on suspicious .rar files.

What your security team should do

  • Prioritize upgrade of libarchive and dependent packages on all internet-facing or high-volume archive processing hosts
  • Add libarchive version checks to vulnerability scanning and asset inventory
  • Block or sandbox untrusted RAR files in email gateways and file-upload services until patching is complete

The record

bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 libarchive 0 3.2.0-2
Debian:12 libarchive 0 3.2.0-2
Debian:13 libarchive 0 3.2.0-2
Debian:8 libarchive 0 3.1.2-11+deb8u2
Red Hat:enterprise_linux:7::client bsdcpio 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::client bsdtar 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::client libarchive 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::client libarchive-debuginfo 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::client libarchive-devel 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::computenode bsdcpio 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::computenode bsdtar 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::computenode libarchive 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::computenode libarchive-debuginfo 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::computenode libarchive-devel 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::server bsdcpio 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::server bsdtar 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::server libarchive 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::server libarchive-debuginfo 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::server libarchive-devel 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::workstation bsdcpio 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::workstation bsdtar 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::workstation libarchive 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::workstation libarchive-debuginfo 0 0:3.1.2-10.el7_2
Red Hat:enterprise_linux:7::workstation libarchive-devel 0 0:3.1.2-10.el7_2
Ubuntu:14.04:LTS libarchive 0 3.1.2-7ubuntu2.3
Ubuntu:16.04:LTS libarchive 0 3.1.2-11ubuntu0.16.04.2

Related vulnerabilities