Red Hat Bugzilla – Bug 1184985
CVE-2014-9636 unzip: out-of-bounds read/write in test_compr_eb() in extract.c
Last modified: 2015-11-25 05:28:13 EST
It was reported  that OOB access (both read and write) issues exist in test_compr_eb (extract.c) that can result in application crash or other unspecified impact.
This vulnerability can be triggered via crafted zip archives with extra fields that advertise STORED method compression (i.e. no compression) and have uncompressed field sizes smaller than the corresponding compressed field sizes.
This issue is different from CVE-2014-8140 .
Proposed patch is attached.
Upstream bugreport: http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450
Created attachment 982909 [details]
Created unzip tracking bugs for this issue:
Affects: fedora-all [bug 1184986]
unzip-6.0-18.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
unzip-6.0-15.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
(In reply to Vasyl Kaigorodov from comment #0)
> This issue is different from CVE-2014-8140
This issue is actually closely related to CVE-2014-8140 / bug 1174851. The fix for that issue addressed a special case by rejecting extra field blocks that indicate a 0 sized uncompressed data. However, it failed to address the case when uncompressed data length stored in the block header was less than the actual amount of data available. However, both fixes are needed. Even with the fix in comment 1, it is possible to trigger integer underflow as described in bug 1174851 comment 5.
Affected code is only reached when running unzip in the test mode (unzip -t), but not when extracting zip archives.
(In reply to Vasyl Kaigorodov from comment #1)
This patch seems to have an incorrect check, that can reject valid extra fields as invalid. See the following oss-security post for details:
Yes, it was incorrect . I bug #1184986 is reopened and repatched already.
Created attachment 990647 [details]
Update to the patch in comment 1.
Created attachment 990649 [details]
Patch as applied to Fedora unzip packages. Equivalent to the patch in comment 9, and should match what was applied upstream.
unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Via RHSA-2015:0700 https://rhn.redhat.com/errata/RHSA-2015-0700.html