Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

HexView discovered a buffer overflow in the zip package. The overflow is triggered by creating a ZIP archive of files with very long path names. This vulnerability might result in execution of arbitrary code with the privileges of the user who calls zip.

This flaw may lead to privilege escalation on systems which automatically create ZIP archives of user-supplied files, like backup systems or web applications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A HexView security advisory reports :

When zip performs recursive folder compression, it does not check for the length of resulting path. If the path is too long, a buffer overflow occurs leading to stack corruption and segmentation fault. It is possible to exploit this vulnerability by embedding a shellcode in directory or file name. While the issue is not of primary concern for regular users, it can be critical for environments where zip archives are re-compressed automatically using Info-Zip application.

A buffer overflow has been discovered in zip, the archiver for .zip files. When doing recursive folder compression the program did not check the resulting path length, which would lead to memory being overwritten. A malicious person could convince a user to create an archive containing a specially crafted path name, which could lead to the execution of arbitrary code.

An updated zip package that fixes a buffer overflow vulnerability is now available.

The zip program is an archiving utility which can create ZIP-compatible archives.

A buffer overflow bug has been discovered in zip when handling long file names. An attacker could create a specially crafted path which could cause zip to crash or execute arbitrary instructions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1010 to this issue.

Users of zip should upgrade to this updated package, which contains backported patches and is not vulnerable to this issue.

A vulnerability in zip was discovered where zip would not check the resulting path length when doing recursive folder compression, which could allow a malicious person to convince a user to create an archive containing a specially crafted path name. By doing so, arbitrary code could be executed with the permissions of the user running zip.

The updated packages are patched to prevent this problem.

The remote host is affected by the vulnerability described in GLSA-200411-16 (zip: Path name buffer overflow)

    zip does not check the resulting path length when doing recursive     folder compression.
  Impact :

    An attacker could exploit this by enticing another user or web     application to create an archive including a specially crafted path     name, potentially resulting in the execution of arbitrary code with the     permissions of the user running zip.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
20590	Ubuntu 4.10 : zip vulnerability (USN-18-1)	Nessus	Ubuntu Local Security Checks	critical
18913	FreeBSD : zip -- long path buffer overflow (40549bbf-43b5-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	critical
16102	Debian DSA-624-1 : zip - buffer overflow	Nessus	Debian Local Security Checks	critical
15990	RHEL 2.1 / 3 : zip (RHSA-2004:634)	Nessus	Red Hat Local Security Checks	critical
15839	Mandrake Linux Security Advisory : zip (MDKSA-2004:141)	Nessus	Mandriva Local Security Checks	critical
15691	GLSA-200411-16 : zip: Path name buffer overflow	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2004-1010

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical