Bug 1642931 (CVE-2018-18384)

Summary:	CVE-2018-18384 unzip: Buffer overflow in list.c resulting in a denial of service
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	abhgupta, dbaker, jamartis, jokerman, kdudka, pstodulk, sthangav, trankin, vvitek
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-08-06 13:20:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1642932, 1655979
Bug Blocks:	1642935

Description Andrej Nemec 2018-10-25 10:31:20 UTC

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.

References:

https://bugzilla.suse.com/show_bug.cgi?id=1110194
https://sourceforge.net/p/infozip/bugs/53/
https://src.fedoraproject.org/rpms/unzip/blob/master/f/unzip-6.0-overflow-long-fsize.patch

Comment 3 Tomas Hoger 2018-12-04 10:51:39 UTC

This is not a new bug, and it shouldn't have got a CVE form 2018.  The problem was reported back in 2014 via:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=741384
http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=432 (no longer available)
https://seclists.org/oss-sec/2014/q4/503

For Red Hat and Fedora, this was handled via bug 1191136.  The issue was not handled as a security flaw, as the overflow was caught by FORTIFY_SOURCE, reducing impact to crash, which is not too relevant for an unzip tool.  The patch linked in comment 0 was added to Fedora packages at the time.

Note that the patch proposed in the SuSE bug also linked in comment 0 also adds sprintf -> snprintf change, which is a hardening, but does not fix any issue when properly sized cfactorstr[] buffer is used.

Comment 6 errata-xmlrpc 2019-08-06 12:22:39 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2159 https://access.redhat.com/errata/RHSA-2019:2159

Comment 7 Product Security DevOps Team 2019-08-06 13:20:24 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-18384