CVE-2018-1000097

What it actually does

Buffer overflow in the looks_like_c_code function in unshar.c at line 75 due to absent bounds checking on input lines, enabling arbitrary code execution.

Why it matters to the business

Attackers can gain code execution on Linux systems if users process untrusted shar archives, increasing risk of compromise across Ubuntu, Debian, and other distributions using sharutils.

How an attack unfolds

An attacker crafts a shar file that triggers the unchecked buffer in looks_like_c_code when a victim runs unshar on it, leading to code execution.

How to fix it

Upgrade sharutils to a patched release from the distribution vendor or disable/uninstall the unshar command; avoid processing untrusted shar archives.

How to confirm the fix worked

Confirm sharutils package version is updated beyond the vulnerable 4.15.2 release and test unshar against known trigger inputs to verify absence of overflow behavior.

Typical attack path

1. Craft malicious shar file to overflow buffer in unshar.c
2. Deliver file to target via email, web, or shared storage
3. Victim executes unshar on the crafted file
4. Overflow leads to arbitrary code execution

How to detect it

Review process execution logs and command history for unshar invocations on files from external or untrusted sources; correlate with subsequent anomalous process creation or privilege escalation.

• unshar
• looks_like_c_code
• /usr/bin/unshar

What your security team should do

• Restrict or remove sharutils from systems where possible
• Apply vendor patches for sharutils immediately
• Block execution of unshar on files from untrusted origins via policy or sandboxing