CVE-2017-14502
High · 7.5CVSS
7.5
EPSS
3.4%
Published
Sep 17, 2017
CISA due date
—
Cloudanix analysis
A bug in software that opens certain archive files can make programs crash when they encounter specially crafted files, interrupting tasks that rely on extracting or reading those archives.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Denial Of Service
- Component
- Library
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
An off-by-one error when processing UTF-16 encoded filenames in RAR archives results in an out-of-bounds read during header parsing in archive_read_support_format_rar.c.
Why it matters to the business
Processing untrusted RAR archives can lead to application crashes or denial of service, potentially disrupting archive extraction workflows across systems that depend on libarchive.
How an attack unfolds
An attacker supplies a malicious RAR archive containing a UTF-16 filename crafted to trigger the off-by-one boundary error. When the vulnerable libarchive library attempts to read the archive header, the out-of-bounds read occurs, which may cause a crash or memory corruption.
How to fix it
Update libarchive to a patched version beyond 3.3.2 that corrects the off-by-one error in UTF-16 name handling for RAR archives. Rebuild and redeploy dependent applications after the library upgrade.
How to confirm the fix worked
Test archive processing with specially crafted RAR files containing boundary UTF-16 names to confirm absence of crashes. Use static analysis or fuzzing tools to verify bounds checks in archive_read_support_format_rar.c.
Typical attack path
- Craft a malicious RAR archive with a UTF-16 filename that triggers the off-by-one condition
- Deliver the archive to a target application or service that uses libarchive for extraction or inspection
- Trigger parsing of the RAR header via archive_read_support_format_rar
- Induce the out-of-bounds read to cause denial of service or potential further memory corruption
How to detect it
Monitor application logs for segmentation faults or memory errors during RAR archive processing. Correlate crashes with inbound RAR files and inspect for patterns matching the vulnerable header parsing routine.
What your security team should do
- Upgrade libarchive across all affected systems and rebuild dependent packages
- Restrict processing of untrusted RAR archives until updates are applied
- Incorporate archive parsing into regular vulnerability scanning and patch management cycles
The record
read_header in archive_read_support_format_rar.c in libarchive 3.3.2 suffers from an off-by-one error for UTF-16 names in RAR archives, leading to an out-of-bounds read in archive_read_format_rar_read_header.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.7 | libarchive | 0 | 3.3.3-r0 |
| Alpine:v3.8 | libarchive | 0 | 3.3.3-r0 |
| Alpine:v3.9 | libarchive | 0 | 3.3.3-r0 |
| Debian:11 | libarchive | 0 | 3.2.2-4.1 |
| Debian:12 | libarchive | 0 | 3.2.2-4.1 |
| Debian:13 | libarchive | 0 | 3.2.2-4.1 |
| Debian:8 | libarchive | 0 | 3.1.2-11+deb8u4 |
| Debian:9 | libarchive | 0 | 3.2.2-2+deb9u1 |
| Mageia:6 | libarchive | 0 | 3.3.1-1.4.mga6 |
| Red Hat:enterprise_linux:8::baseos | bsdcat-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | bsdcpio-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | bsdtar | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | bsdtar-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | libarchive | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | libarchive-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | libarchive-debugsource | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::baseos | libarchive-devel | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | bsdcat-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | bsdcpio-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | bsdtar | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | bsdtar-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | libarchive | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | libarchive-debuginfo | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | libarchive-debugsource | 0 | 0:3.3.3-1.el8 |
| Red Hat:enterprise_linux:8::crb | libarchive-devel | 0 | 0:3.3.3-1.el8 |
| SUSE:Enterprise Storage 6 | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Desktop 12 SP3 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Desktop 12 SP4 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Desktop 12 SP4 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15-ESPOS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise High Performance Computing 15-LTSS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 | libarchive | 0 | 3.3.2-3.3.2 |
| SUSE:Linux Enterprise Module for Development Tools 15 | libarchive | 0 | 3.3.2-3.3.2 |
| SUSE:Linux Enterprise Server 12 SP3 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Server 12 SP4 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Server 12 SP4 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise Server 12 SP5 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise Server 15 SP1-BCL | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Server 15 SP1-LTSS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Server 15-LTSS | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP4 | libarchive | 0 | 3.1.2-26.3.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP4 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP5 | libarchive | 0 | 3.1.2-26.6.1 |
| SUSE:Manager Proxy 4.0 | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Manager Retail Branch Server 4.0 | libarchive | 0 | 3.3.3-3.14.1 |
| SUSE:Manager Server 4.0 | libarchive | 0 | 3.3.3-3.14.1 |
| Ubuntu:14.04:LTS | libarchive | 0 | 3.1.2-7ubuntu2.7 |
| Ubuntu:16.04:LTS | libarchive | 0 | 3.1.2-11ubuntu0.16.04.5 |
| Ubuntu:18.04:LTS | libarchive | 0 | 3.2.2-3.1ubuntu0.2 |
Related vulnerabilities
- JLSEC-2025-250 libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in… Also affects libarchive
- CVE-2024-57970 libarchive through 3.7.7 has a heap-based buffer over-read in header_gnu_longlink in… Also affects libarchive
- CVE-2024-20696 Windows Libarchive Remote Code Execution Vulnerability Also affects libarchive
- CVE-2016-10209 The archive_wstring_append_from_mbs function in archive_string.c in libarchive 3.2.2… Also affects libarchive
- CVE-2016-5418 The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries… Also affects libarchive
- CVE-2015-8921 The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote… Also affects libarchive
- CVE-2015-8916 bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when… Also affects libarchive
- CVE-2016-1541 Heap-based buffer overflow in the zip_read_mac_metadata function in… Also affects libarchive