Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.

Upgraded infozip packages are available for Slackware 9.0 and
-current. These fix a security issue where a specially crafted archive may overwrite files (including system files anywhere on the filesystem) upon extraction by a user with sufficient permissions.

A directory traversal vulnerability in UnZip 5.50 allows attackers to bypass a check for relative pathnames ('../') by placing certain invalid characters between the two '.' characters. The fix which was implemented in DSA-344-1 may not have protected against all methods of exploiting this vulnerability.

A vulnerability was discovered in unzip 5.50 and earlier that allows attackers to overwrite arbitrary files during archive extraction by placing non-printable characters between two '.' characters. These invalid characters are filtered which results in a '..' sequence.

The patch applied to these packages prevents unzip from writing to parent directories unless the '-:' command line option is used.

Update :

Ben Laurie found that the original patch used to fix this issue missed a case where the path component included a quoted slash. An updated patch was used to build these packages.

Updated unzip packages resolving a vulnerability allowing arbitrary files to be overwritten are now available.

[Updated 15 August 2003] Ben Laurie found that the original patch to fix this issue missed a case where the path component included a quoted slash. These updated packages contain a new patch that corrects this issue.

The unzip utility is used for manipulating archives, which are multiple files stored inside of a single file.

A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to overwrite arbitrary files during archive extraction by placing invalid (non-printable) characters between two '.' characters. These non-printable characters are filtered, resulting in a '..' sequence.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0282 to this issue.

This erratum includes a patch ensuring that non-printable characters do not make it possible for a malicious .zip file to write to parent directories unless the '-:' command line parameter is specified.

Users of unzip are advised to upgrade to these updated packages, which are not vulnerable to this issue.

ID	Name	Product	Family	Severity
18722	Slackware 9.0 / current : unzip vulnerability patched (SSA:2003-237-01)	Nessus	Slackware Local Security Checks	low
15181	Debian DSA-344-2 : unzip - directory traversal	Nessus	Debian Local Security Checks	low
14056	Mandrake Linux Security Advisory : unzip (MDKSA-2003:073-1)	Nessus	Mandriva Local Security Checks	low
12403	RHEL 2.1 : unzip (RHSA-2003:200)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2003-0282

high

Tenable Plugins

low

low

low

low