CVE-2024-37407
📋 TL;DR
This vulnerability in Libarchive allows out-of-bounds memory access when processing ZIP archives with empty filenames and macOS extended attributes enabled. Attackers could potentially execute arbitrary code or cause denial of service by crafting malicious ZIP files. Any system or application using vulnerable Libarchive versions to extract ZIP archives is affected.
💻 Affected Systems
- Libarchive
- Applications using Libarchive library
📦 What is this software?
Libarchive by Libarchive
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if exploited via malicious ZIP file processing
Likely Case
Application crash or denial of service when processing specially crafted ZIP archives
If Mitigated
Limited to denial of service if memory protections like ASLR are effective
🎯 Exploit Status
Exploitation requires crafting a ZIP archive with specific characteristics and likely requires bypassing memory protections
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.4
Vendor Advisory: https://github.com/libarchive/libarchive/releases/tag/v3.7.4
Restart Required: No
Instructions:
1. Download Libarchive 3.7.4 or later from official repository. 2. Compile and install following standard build procedures. 3. Recompile any applications using Libarchive against the updated library.
🔧 Temporary Workarounds
Disable macOS extended attributes processing
allConfigure applications to disable mac-ext feature when processing ZIP files
Set environment variable: export ARCHIVE_MAC_EXT=0
Or configure application to not use mac-ext option
Reject ZIP files with empty filenames
allImplement pre-processing to detect and reject ZIP archives containing files with empty names
🧯 If You Can't Patch
- Implement strict input validation to reject ZIP files with empty filenames
- Use application sandboxing or containerization to limit potential impact
🔍 How to Verify
Check if Vulnerable:
Check Libarchive version: archive_version_details() or check installed package versionCheck Version:
archive_version() from libarchive API or check package manager: dpkg -l libarchive* | grep ^ii on Debian/Ubuntu, rpm -qa | grep libarchive on RHEL/CentOSVerify Fix Applied:
Verify version is 3.7.4 or later: archive_version() should return 'libarchive 3.7.4' or higher📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing ZIP files
- Memory access violation errors in system logs
- Unexpected process termination of archive-related applications
Network Indicators:
- Multiple failed attempts to upload ZIP files
- Unusual network traffic patterns to/from archive processing services
SIEM Query:
process.name:"archive" AND (event.action:"crash" OR event.outcome:"failure") AND file.extension:"zip"🔗 References
- https://github.com/libarchive/libarchive/commit/b6a979481b7d77c12fa17bbed94576b63bbcb0c0
- https://github.com/libarchive/libarchive/pull/2145
- https://github.com/libarchive/libarchive/releases/tag/v3.7.4
- https://github.com/libarchive/libarchive/commit/b6a979481b7d77c12fa17bbed94576b63bbcb0c0
- https://github.com/libarchive/libarchive/pull/2145
- https://github.com/libarchive/libarchive/releases/tag/v3.7.4
