Bug 803028 (CVE-2012-1163)

Summary: CVE-2012-1163 libzip: integer overflow when processing malformed zip file
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jlieskov, jorton, scorneli, security-response-team, vvitek
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: libzip 0.10.1 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-04-16 14:53:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 805102, 805104    
Bug Blocks: 802568    
Attachments:
Description Flags
patch from upstream none

Description Vincent Danen 2012-03-13 19:40:11 UTC 
An integer overflow vulnerability was reported in libzip <= 0.10 when processing certain corrupt zip files.  When libzip opens a zip file, it reads in the size and the offset of the central directory structure and, while it performs a consistency check on these values, it does not anticipate an integer overflow.  In this case libzip will continue to process the zip file, which may result in the improper restrictions of operations within the bounds of a memory buffer.


Acknowledgements:

Red Hat would like to thank Timo Warns for reporting this issue.
Comment 1 Vincent Danen 2012-03-15 21:11:54 UTC 
Created attachment 570438 [details]
patch from upstream
Comment 2 Vincent Danen 2012-03-20 14:51:57 UTC 
This is now public:

http://nih.at/listarchive/libzip-discuss/msg00252.html
http://hg.nih.at/libzip?fd=cb69d6146a09;file=lib/zip_open.c
Comment 3 Vincent Danen 2012-03-20 14:54:14 UTC 
Created php tracking bugs for this issue

Affects: fedora-all [bug 805104]
Comment 4 Vincent Danen 2012-03-20 14:54:19 UTC 
Created libzip tracking bugs for this issue

Affects: fedora-all [bug 805102]
Comment 6 Stefan Cornelius 2012-03-28 04:26:02 UTC 
The vulnerability was introduced by patch http://hg.nih.at/libzip?cs=feb6cbf7e8c4 in version 0.10.

Statement:

Not vulnerable. This issue did not affect the versions of libzip and php as shipped with Red Hat Enterprise Linux 6. This issue did not affect the versions of php53 as shipped with Red Hat Enterprise Linux 5.
Comment 7 Fedora Update System 2012-04-12 02:48:23 UTC 
libzip-0.10.1-1.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Stefan Cornelius 2012-04-16 14:53:53 UTC 
Vulnerability was introduced in a version later than shipped with F15 and F16. F17 now ships version 0.10.1, which fixes the issue.
Comment 9 Jan Lieskovsky 2012-07-13 09:42:19 UTC 
References:
http://nih.at/listarchive/libzip-discuss/msg00252.html
http://www.openwall.com/lists/oss-security/2012/03/21/2
http://www.openwall.com/lists/oss-security/2012/03/29/11
http://www.nih.at/libzip/NEWS.html
http://www.gentoo.org/security/en/glsa/glsa-201203-23.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2012:034