Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.

From Red Hat Security Advisory 2007:0203 :

Updated unzip packages that fix two security issues and various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The unzip utility is used to list, test, or extract files from a zip archive.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

As well, this update adds support for files larger than 2GB.

All users of unzip should upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated unzip packages that fix two security issues and various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The unzip utility is used to list, test, or extract files from a zip archive.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

As well, this update adds support for files larger than 2GB.

All users of unzip should upgrade to these updated packages, which contain backported patches that resolve these issues.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

A buffer overflow in the command line argument parsing has been discovered in unzip, the de-archiver for ZIP files, that could lead to the execution of arbitrary code.

A buffer overflow was discovered in the handling of file name arguments. By tricking a user or automated system into processing a specially crafted, excessively long file name with unzip, an attacker could exploit this to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was foiund in how unzip handles file name arguments.
If a user could tricked into processing a specially crafted, excessively long file name with unzip, an attacker could execute arbitrary code with the user's privileges.

The updated packages have been patched to address this issue.

ID	Name	Product	Family	Severity
67473	Oracle Linux 4 : unzip (ELSA-2007-0203)	Nessus	Oracle Linux Local Security Checks	low
67039	CentOS 4 : unzip (CESA-2007:0203)	Nessus	CentOS Local Security Checks	low
60171	Scientific Linux Security Update : unzip on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
25135	RHEL 4 : unzip (RHSA-2007:0203)	Nessus	Red Hat Local Security Checks	low
22554	Debian DSA-1012-1 : unzip - buffer overflow	Nessus	Debian Local Security Checks	low
21056	Ubuntu 4.10 / 5.04 / 5.10 : unzip vulnerability (USN-248-1)	Nessus	Ubuntu Local Security Checks	low
21003	Mandrake Linux Security Advisory : unzip (MDKSA-2006:050)	Nessus	Mandriva Local Security Checks	low

Detections

Analytics

CVE-2005-4667

high

Tenable Plugins

low

low

low

low

low

low

low