Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1184985 - (CVE-2014-9636) CVE-2014-9636 unzip: out-of-bounds read/write in test_compr_eb() in extract.c
CVE-2014-9636 unzip: out-of-bounds read/write in test_compr_eb() in extract.c
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
Frantisek Sumsal
impact=moderate,public=20141102,repor...
: Security
Depends On: 1184986 1196132 1196133 1196134 1196135
Blocks: 1174865
  Show dependency treegraph
 
Reported: 2015-01-22 11:03 EST by Vasyl Kaigorodov
Modified: 2015-11-25 05:28 EST (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-03-18 17:11:09 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
unzip-6.0_overflow2.diff (1.44 KB, patch)
2015-01-22 11:04 EST, Vasyl Kaigorodov
no flags Details | Diff
Updated patch (1.47 KB, patch)
2015-02-11 16:09 EST, Tomas Hoger
no flags Details | Diff
Upstream patch (1.01 KB, patch)
2015-02-11 16:13 EST, Tomas Hoger
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0700 normal SHIPPED_LIVE Moderate: unzip security update 2015-03-18 18:58:14 EDT

  None (edit)
Description Vasyl Kaigorodov 2015-01-22 11:03:19 EST
It was reported [1] that OOB access (both read and write) issues exist in test_compr_eb (extract.c) that can result in application crash or other unspecified impact.

This vulnerability can be triggered via crafted zip archives with extra fields that advertise STORED method compression (i.e. no compression) and have uncompressed field sizes smaller than the corresponding compressed field sizes.

This issue is different from CVE-2014-8140 [2].

Proposed patch is attached.
Upstream bugreport: http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450

[1]: http://seclists.org/oss-sec/2014/q4/1131
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140
Comment 1 Vasyl Kaigorodov 2015-01-22 11:04:14 EST
Created attachment 982909 [details]
unzip-6.0_overflow2.diff
Comment 2 Vasyl Kaigorodov 2015-01-22 11:04:56 EST
Created unzip tracking bugs for this issue:

Affects: fedora-all [bug 1184986]
Comment 3 Fedora Update System 2015-01-28 14:58:32 EST
unzip-6.0-18.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-01-29 23:34:59 EST
unzip-6.0-15.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Tomas Hoger 2015-02-10 07:42:38 EST
(In reply to Vasyl Kaigorodov from comment #0)
> This issue is different from CVE-2014-8140

This issue is actually closely related to CVE-2014-8140 / bug 1174851.  The fix for that issue addressed a special case by rejecting extra field blocks that indicate a 0 sized uncompressed data.  However, it failed to address the case when uncompressed data length stored in the block header was less than the actual amount of data available.  However, both fixes are needed.  Even with the fix in comment 1, it is possible to trigger integer underflow as described in bug 1174851 comment 5.
Comment 6 Tomas Hoger 2015-02-10 07:44:57 EST
Affected code is only reached when running unzip in the test mode (unzip -t), but not when extracting zip archives.
Comment 7 Tomas Hoger 2015-02-10 08:35:41 EST
(In reply to Vasyl Kaigorodov from comment #1)
> unzip-6.0_overflow2.diff

This patch seems to have an incorrect check, that can reject valid extra fields as invalid.  See the following oss-security post for details:

http://seclists.org/oss-sec/2015/q1/496
Comment 8 pstodulk 2015-02-11 11:32:13 EST
Yes, it was incorrect [0]. I bug #1184986 is reopened and repatched already.

[0] http://seclists.org/oss-sec/2015/q1/507
Comment 10 Tomas Hoger 2015-02-11 16:13:48 EST
Created attachment 990649 [details]
Upstream patch

Patch as applied to Fedora unzip packages.  Equivalent to the patch in comment 9, and should match what was applied upstream.

http://seclists.org/oss-sec/2015/q1/515
Comment 11 Fedora Update System 2015-02-15 22:25:49 EST
unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Fedora Update System 2015-02-23 18:25:23 EST
unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 Martin Prpič 2015-02-25 05:25:47 EST
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/
Comment 16 errata-xmlrpc 2015-03-18 14:59:18 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0700 https://rhn.redhat.com/errata/RHSA-2015-0700.html

Note You need to log in before you can comment on or make changes to this bug.