製品・ソフトウェアに関する情報

JVN脆弱性詳細

libtar の lib/block.c の th_read 関数における整数オーバーフローの脆弱性

Title	libtar の lib/block.c の th_read 関数における整数オーバーフローの脆弱性
Summary	libtar の lib/block.c の th_read 関数には、整数オーバーフローの脆弱性が存在します。
Possible impacts	第三者により、アーカイブ内の過度に長い (1) 名前または (2) リンクを介して、ヒープベースのバッファオーバーフローを誘発されることで、サービス運用妨害 (クラッシュ) 状態にされる、および任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 1, 2013, midnight
Registration Date	Oct. 22, 2013, 10:29 a.m.
Last Update	Jan. 9, 2014, 6:22 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux Desktop (v. 6)

Red Hat Enterprise Linux HPC Node (v. 6)

Red Hat Enterprise Linux Server (v. 6)

Red Hat Enterprise Linux Server AUS (v. 6.4)

Red Hat Enterprise Linux Server EUS (v. 6.4.z)

Red Hat Enterprise Linux Workstation (v. 6)

feep.net

libtar 1.2.20 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4397	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4397
National Vulnerability Database (NVD)
2	CVE-2013-4397	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4397

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
Debian セキュリティ勧告
1	DSA-2817	http://www.debian.org/security/2013/dsa-2817
Red Hat Security Advisory
2	RHSA-2013:1418	http://rhn.redhat.com/errata/RHSA-2013-1418.html
repo.or.cz
3	Fixed size_t overflow bug, as reported by Timo Warns	http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04

Change Log

No	Changed Details	Date of change
0	[2013年10月22日] 掲載 [2014年01月09日] ベンダ情報：Debian (DSA-2817) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-4397

Summary	Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) name or (2) link in an archive, which triggers a heap-based buffer overflow.
Publication Date	Oct. 18, 2013, 8:55 a.m.
Registration Date	Jan. 26, 2021, 3:43 p.m.
Last Update	Nov. 21, 2024, 10:55 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04	Exploit Patch
2	http://repo.or.cz/w/libtar.git/commitdiff/45448e8bae671c2f7e80b860ae0fc0cedf2bdc04	Exploit Patch
3	http://rhn.redhat.com/errata/RHSA-2013-1418.html	Vendor Advisory
4	http://rhn.redhat.com/errata/RHSA-2013-1418.html	Vendor Advisory
5	http://secunia.com/advisories/55188	Vendor Advisory
6	http://secunia.com/advisories/55188	Vendor Advisory
7	http://secunia.com/advisories/55253	Vendor Advisory
8	http://secunia.com/advisories/55253	Vendor Advisory
9	http://www.debian.org/security/2013/dsa-2817
10	http://www.debian.org/security/2013/dsa-2817
11	http://www.openwall.com/lists/oss-security/2013/10/10/4
12	http://www.openwall.com/lists/oss-security/2013/10/10/4
13	http://www.openwall.com/lists/oss-security/2013/10/10/6
14	http://www.openwall.com/lists/oss-security/2013/10/10/6
15	http://www.securityfocus.com/bid/62922
16	http://www.securityfocus.com/bid/62922
17	http://www.securitytracker.com/id/1029166
18	http://www.securitytracker.com/id/1029166
19	http://www.securitytracker.com/id/1040106
20	http://www.securitytracker.com/id/1040106
21	https://lists.feep.net:8080/pipermail/libtar/2013-October/000361.html
22	https://lists.feep.net:8080/pipermail/libtar/2013-October/000361.html
23	https://source.android.com/security/bulletin/2018-01-01
24	https://source.android.com/security/bulletin/2018-01-01

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html