It was reported [1] that OOB access (both read and write) issues exist in test_compr_eb (extract.c) that can result in application crash or other unspecified impact. This vulnerability can be triggered via crafted zip archives with extra fields that advertise STORED method compression (i.e. no compression) and have uncompressed field sizes smaller than the corresponding compressed field sizes. This issue is different from CVE-2014-8140 [2]. Proposed patch is attached. Upstream bugreport: http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450 [1]: http://seclists.org/oss-sec/2014/q4/1131 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8140
Created attachment 982909 [details] unzip-6.0_overflow2.diff
Created unzip tracking bugs for this issue: Affects: fedora-all [bug 1184986]
unzip-6.0-18.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
unzip-6.0-15.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
(In reply to Vasyl Kaigorodov from comment #0) > This issue is different from CVE-2014-8140 This issue is actually closely related to CVE-2014-8140 / bug 1174851. The fix for that issue addressed a special case by rejecting extra field blocks that indicate a 0 sized uncompressed data. However, it failed to address the case when uncompressed data length stored in the block header was less than the actual amount of data available. However, both fixes are needed. Even with the fix in comment 1, it is possible to trigger integer underflow as described in bug 1174851 comment 5.
Affected code is only reached when running unzip in the test mode (unzip -t), but not when extracting zip archives.
(In reply to Vasyl Kaigorodov from comment #1) > unzip-6.0_overflow2.diff This patch seems to have an incorrect check, that can reject valid extra fields as invalid. See the following oss-security post for details: http://seclists.org/oss-sec/2015/q1/496
Yes, it was incorrect [0]. I bug #1184986 is reopened and repatched already. [0] http://seclists.org/oss-sec/2015/q1/507
Created attachment 990647 [details] Updated patch Update to the patch in comment 1. http://seclists.org/oss-sec/2015/q1/513 http://sf.net/projects/mancha/files/sec/unzip-6.0_overflow3.diff
Created attachment 990649 [details] Upstream patch Patch as applied to Fedora unzip packages. Equivalent to the patch in comment 9, and should match what was applied upstream. http://seclists.org/oss-sec/2015/q1/515
unzip-6.0-20.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
unzip-6.0-17.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
Statement: Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Via RHSA-2015:0700 https://rhn.redhat.com/errata/RHSA-2015-0700.html