CVE-2016-10209

What it actually does

The archive_wstring_append_from_mbs function in libarchive performs insufficient validation on multibyte string data from an archive, resulting in a NULL pointer dereference and immediate process crash.

Why it matters to the business

Applications that process untrusted archive files can be forced offline by a single malicious file, interrupting services that rely on archive handling and requiring manual restarts or failover.

How an attack unfolds

An attacker crafts a malicious archive containing data that triggers the faulty multibyte string handling path, then supplies the file to a target application using the vulnerable libarchive version; when the application attempts to process the archive, the NULL dereference occurs and the process terminates.

How to fix it

Upgrade libarchive to a version containing the fix for the NULL dereference. For the listed Cassandra packages, the supplied fixed versions already incorporate the corrected libarchive dependency; verify the running libarchive version meets or exceeds the patched release.

How to confirm the fix worked

Confirm the installed libarchive shared library or package version is newer than 3.2.2, then attempt to process a known-triggering archive in a test environment and verify the process no longer crashes.

Typical attack path

1. Identify an application or service that uses libarchive to extract or inspect archives
2. Craft an archive file that reaches the vulnerable append-from-mbs code path
3. Deliver the archive to the target (local file, download, or attachment)
4. Trigger archive processing, causing the NULL dereference and crash

How to detect it

Review application and system logs for sudden crashes or segmentation faults during archive extraction; correlate crash timestamps with file-access events involving archive formats.

What your security team should do

• Inventory all systems and containers that link against libarchive and prioritize upgrades where archive processing occurs on untrusted input
• Apply the fixed package versions provided for the affected Cassandra images
• Add archive-processing components to the vulnerability scanning and patch-management workflow
• Monitor for new public exploits given the ExploitAvailable maturity rating