Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1174851 - (CVE-2014-8140) CVE-2014-8140 unzip: out-of-bounds write issue in test_compr_eb() (oCERT-2014-011)
CVE-2014-8140 unzip: out-of-bounds write issue in test_compr_eb() (oCERT-2014...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
Frantisek Sumsal
impact=low,public=20141222,reported=2...
: Security
Depends On: 1191118 1196124 1196125 1196126 1196127
Blocks: 1174865
  Show dependency treegraph
 
Reported: 2014-12-16 10:35 EST by Tomas Hoger
Modified: 2015-11-25 05:28 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-03-18 17:11:16 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Upstream patch (1.14 KB, patch)
2014-12-16 10:42 EST, Tomas Hoger
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 1360443 None None None Never
Red Hat Product Errata RHSA-2015:0700 normal SHIPPED_LIVE Moderate: unzip security update 2015-03-18 18:58:14 EDT

  None (edit)
Description Tomas Hoger 2014-12-16 10:35:58 EST
oCERT reports an unzip flaw discovered by Michele Spagnuolo, Google Security Team:

"""
The write error shows a problem in extract.c:test_compr_eb(), which was not expecting an uncompressed size of zero for an EF_NTSD extra block.

Proposed changes:

http://antinode.info/ftp/info-zip/unzip60/extract.c

extract.c:test_compr_eb() gets a new validity test.
"""

Acknowledgement:

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.
Comment 2 Tomas Hoger 2014-12-16 10:42:25 EST
Created attachment 969621 [details]
Upstream patch

This seems to be the upstream fix mentioned in the comment 0.
Comment 4 Huzaifa S. Sidhpurwala 2014-12-22 10:49:05 EST
External Reference:

http://www.ocert.org/advisories/ocert-2014-011.html
Comment 5 Tomas Hoger 2015-02-10 07:36:54 EST
Upstream patch in comment 2 does not address all related problems completely.  See CVE-2014-9636 / bug 1184985 to address issues identified by the oCERT-2014-011 test case.

The problem the patch in comment 2 addresses is an uncompressed data size of 0 specified in certain extra field blocks (such as EF_NTSD mentioned in the report, but other types were affected as well).  If a zip file indicated that uncompressed data size was 0, unzip skipped the check to ensure that there were still enough data in the current extra field block to hold compression data header.  When using STORE compression (i.e. data stored uncompressed), this led to integer underflow, resulting in memcpy() getting called with excessively large size argument, causing it to over-read and over-write input and output buffers and crash.  This is unlikely to allow code execution.

Affected code is only reached when running unzip in the test mode (unzip -t), but not when extracting zip archives.
Comment 6 Tomas Hoger 2015-02-10 08:37:08 EST
Created unzip tracking bugs for this issue:

Affects: fedora-all [bug 1191118]
Comment 8 Fedora Update System 2015-02-15 22:25:45 EST
unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2015-02-23 18:25:19 EST
unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Martin Prpič 2015-02-25 05:25:26 EST
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/
Comment 13 errata-xmlrpc 2015-03-18 14:59:13 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6
  Red Hat Enterprise Linux 7

Via RHSA-2015:0700 https://rhn.redhat.com/errata/RHSA-2015-0700.html

Note You need to log in before you can comment on or make changes to this bug.