GLSA-200603-05 : zoo: Stack-based buffer overflow
Medium Nessus Plugin ID 21022
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200603-05 (zoo: Stack-based buffer overflow)
Jean-Sebastien Guay-Leroux discovered a boundary error in the fullpath() function in misc.c when processing overly long file and directory names in ZOO archives.
An attacker could craft a malicious ZOO archive and entice someone to open it using zoo. This would trigger a stack-based buffer overflow and potentially allow execution of arbitrary code with the rights of the victim user.
There is no known workaround at this time.
SolutionAll zoo users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=app-arch/zoo-2.10-r1'