Bug 1184985 (CVE-2014-9636)
| Summary: | CVE-2014-9636 unzip: out-of-bounds read/write in test_compr_eb() in extract.c | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> | ||||||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Frantisek Sumsal <fsumsal> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | unspecified | CC: | fsumsal, mluscon, pstodulk, raysatiro | ||||||||
| Target Milestone: | --- | Keywords: | Security | ||||||||
| Target Release: | --- | ||||||||||
| Hardware: | All | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||||
| Doc Text: |
A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option.
|
Story Points: | --- | ||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2015-03-18 21:11:09 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Bug Depends On: | 1184986, 1196132, 1196133, 1196134, 1196135 | ||||||||||
| Bug Blocks: | 1174865 | ||||||||||
| Attachments: |
|
||||||||||
|
Description
Vasyl Kaigorodov
2015-01-22 16:03:19 UTC
Created attachment 982909 [details]
unzip-6.0_overflow2.diff
Created unzip tracking bugs for this issue: Affects: fedora-all [bug 1184986] unzip-6.0-18.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. unzip-6.0-15.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. (In reply to Vasyl Kaigorodov from comment #0) > This issue is different from CVE-2014-8140 This issue is actually closely related to CVE-2014-8140 / bug 1174851. The fix for that issue addressed a special case by rejecting extra field blocks that indicate a 0 sized uncompressed data. However, it failed to address the case when uncompressed data length stored in the block header was less than the actual amount of data available. However, both fixes are needed. Even with the fix in comment 1, it is possible to trigger integer underflow as described in bug 1174851 comment 5. Affected code is only reached when running unzip in the test mode (unzip -t), but not when extracting zip archives. (In reply to Vasyl Kaigorodov from comment #1) > unzip-6.0_overflow2.diff This patch seems to have an incorrect check, that can reject valid extra fields as invalid. See the following oss-security post for details: http://seclists.org/oss-sec/2015/q1/496 Yes, it was incorrect [0]. I bug #1184986 is reopened and repatched already. [0] http://seclists.org/oss-sec/2015/q1/507 Created attachment 990647 [details] Updated patch Update to the patch in comment 1. http://seclists.org/oss-sec/2015/q1/513 http://sf.net/projects/mancha/files/sec/unzip-6.0_overflow3.diff Created attachment 990649 [details] Upstream patch Patch as applied to Fedora unzip packages. Equivalent to the patch in comment 9, and should match what was applied upstream. http://seclists.org/oss-sec/2015/q1/515 unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report. unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report. Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/ This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:0700 https://rhn.redhat.com/errata/RHSA-2015-0700.html |