Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

An update of the unzip package has been released.

New infozip packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201611-01 (UnZip: Multiple vulnerabilities)

    Multiple vulnerabilities were found in UnZip. Please review the       referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could execute arbitrary code or cause Denial of       Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.4 and the following components contain vulnerabilities :

  - Admin Framework 
-  afpserver 
 - apache 
 - AppleFSCompression 
 - AppleGraphicsControl 
 - AppleThunderboltEDMService 
 - ATS 
 - Bluetooth 
 - Certificate Trust Policy 
 - CFNetwork HTTPAuthentication 
 - CoreText 
 - coreTLS 
 - DiskImages 
 - Display Drivers 
 - EFI 
 - FontParser 
 - Graphics Driver 
 - ImageIO 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAcceleratorFamily 
 - IOFireWireFamily 
 - Kernel 
 - kext tools 
 - Mail 
 - ntfs 
 - ntp 
 - OpenSSL 
 - QuickTime 
 - Security 
 - Spotlight 
 - SQLite 
 - System Stats 
 - TrueTypeScaler 
 - zip

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Updated unzip package fix security vulnerabilities :

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues.

A flaw was found in the test_compr_eb() function allowing out-of-bounds read and write access to memory locations. By carefully crafting a corrupt ZIP archive an attacker can trigger a heap overflow, resulting in application crash or possibly having other unspecified impact.

Additionally this update corrects a defective patch applied to address CVE-2014-8139, which caused a regression with executable jar files.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139), the test_compr_eb() function (CVE-2014-8140) and the getZip64Data() function (CVE-2014-8141), which may lead to the execution of arbitrary code.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140     (CVE-2014-8141) Resolves: #1196132 #1196120 #1196124     #1196128

Updated unzip packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The unzip utility is used to list, test, or extract files from a zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter of these issues.

All unzip users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

From Red Hat Security Advisory 2015:0700 :

Updated unzip packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The unzip utility is used to list, test, or extract files from a zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter of these issues.

All unzip users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

This update fixes the following security issues :

  - input sanitization errors. (bnc#909214). (CVE-2014-8139)

  - out-of-bounds read/write in test_compr_eb()     (bnc#914442). (CVE-2014-9636)

- Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - CVE-2014-9636 unzip: out-of-bounds read/write in     test_compr_eb() in extract.c - re-fix (see     https://bugzilla.redhat.com/show_bug.cgi?id=1184985#c7)

    - Fix CVE-2014-8139 - CRC32 verification heap-based       buffer overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

unzip was updated to fix security issues.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() functions (CVE-2014-8141). The input errors may result in in arbitrary code execution.

More info can be found in the oCert announcement:
http://seclists.org/oss-sec/2014/q4/1127

This update fixes the following security issues :

  - heap overflow condition in the CRC32 verification.
    (CVE-2014-8139)

  - write error (_8349_) shows a problem in     extract.c:test_compr_eb(). (CVE-2014-8140)

  - read errors (_6430_, _3422_) show problems in     process.c:getZip64Data(). (CVE-2014-8141)

oCERT reports :

The UnZip tool is an open source extraction utility for archives compressed in the zip format.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the test_compr_eb() and the getZip64Data() functions. The input errors may result in arbitrary code execution.

A specially crafted zip file, passed to unzip -t, can be used to trigger the vulnerability.

Wolfgang Ettlinger discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated unzip package fix security vulnerabilities :

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues (CVE-2014-9636).

Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139 ), the test_compr_eb() function (CVE-2014-8140 ) and the getZip64Data() function (CVE-2014-8141 ), which may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
134423	Photon OS 2.0: Unzip PHSA-2020-2.0-0213	Nessus	PhotonOS Local Security Checks	high
134212	Photon OS 3.0: Unzip PHSA-2020-3.0-0063	Nessus	PhotonOS Local Security Checks	high
134208	Photon OS 1.0: Unzip PHSA-2020-1.0-0281	Nessus	PhotonOS Local Security Checks	high
122576	Slackware 14.0 / 14.1 / 14.2 / current : infozip (SSA:2019-060-01)	Nessus	Slackware Local Security Checks	high
94460	GLSA-201611-01 : UnZip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
8801	Mac OS X < 10.10.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
85950	F5 Networks BIG-IP : Multiple unzip vulnerabilities (SOL16480)	Nessus	F5 Networks Local Security Checks	high
82832	Amazon Linux AMI : unzip (ALAS-2015-504)	Nessus	Amazon Linux Local Security Checks	high
82376	Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)	Nessus	Mandriva Local Security Checks	high
82263	Scientific Linux Security Update : unzip on SL6.x, SL7.x i386/x86_64 (20150318)	Nessus	Scientific Linux Local Security Checks	high
82133	Debian DLA-150-1 : unzip security update	Nessus	Debian Local Security Checks	high
82107	Debian DLA-124-1 : unzip security update	Nessus	Debian Local Security Checks	high
81968	OracleVM 3.3 : unzip (OVMSA-2015-0037)	Nessus	OracleVM Local Security Checks	high
81949	RHEL 6 / 7 : unzip (RHSA-2015:0700)	Nessus	Red Hat Local Security Checks	high
81947	Oracle Linux 6 / 7 : unzip (ELSA-2015-0700)	Nessus	Oracle Linux Local Security Checks	high
81925	CentOS 6 / 7 : unzip (CESA-2015:0700)	Nessus	CentOS Local Security Checks	high
81543	SuSE 11.3 Security Update : unzip (SAT Patch Number 10344)	Nessus	SuSE Local Security Checks	medium
81542	SuSE 11.3 Security Update : unzip (SAT Patch Number 10344)	Nessus	SuSE Local Security Checks	medium
81454	Fedora 20 : unzip-6.0-17.fc20 (2015-1993)	Nessus	Fedora Local Security Checks	medium
81367	Fedora 21 : unzip-6.0-20.fc21 (2015-2035)	Nessus	Fedora Local Security Checks	medium
81252	openSUSE Security Update : unzip (openSUSE-2015-119)	Nessus	SuSE Local Security Checks	high
80825	SuSE 11.3 Security Update : unzip (SAT Patch Number 10159)	Nessus	SuSE Local Security Checks	high
80577	FreeBSD : unzip -- input sanitization errors (d9360908-9d52-11e4-87fd-10bf48e1088e)	Nessus	FreeBSD Local Security Checks	high
80551	Ubuntu 14.04 LTS : unzip vulnerabilities (USN-2472-1)	Nessus	Ubuntu Local Security Checks	high
80435	Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)	Nessus	Mandriva Local Security Checks	medium
80255	Debian DSA-3113-1 : unzip - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-8139

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

medium

medium

medium

medium

high

high

high

high

medium

high