Executive brief
LHA for UNIX is a utility used to compress and decompress files in the LHA archive format. A vulnerability exists where a maliciously crafted archive file can cause the software to crash or potentially allow an attacker to execute unauthorized commands. This could lead to data theft or a complete takeover of the system processing the file.
Technical details
An integer underflow vulnerability exists in header.c within LHA for UNIX (specifically in the level0 and level1 header parsing logic). The root cause is a lack of validation on the header_size byte read from the archive; when this value is less than 19, the calculation 'header_size + 2 - COMMON_HEADER_SIZE' (where COMMON_HEADER_SIZE is 21) results in a large unsigned integer. This value is subsequently passed to fread(), leading to a heap-based buffer overflow. An attacker can exploit this by providing a crafted LHA file to be processed by the utility, potentially achieving remote code execution or denial of service. The issue was patched in January 2016 in commit bf2471f.
Affected products
- LHA for UNIX Project LHA for UNIX All versions prior to commit bf2471f
Timeline
- 2016-01-13: disclosed: Bug report submitted to developers
- 2016-01-16: patched: Fix pushed to master branch (commit bf2471f)
- 2016-01-18: advisory: Public disclosure on oss-security mailing list
- 2017-01-23: advisory: NVD publication date