Bug 1593001 (CVE-2018-1000544) - CVE-2018-1000544 rubyzip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file
Summary: CVE-2018-1000544 rubyzip: arbitrary file write vulnerability / arbitrary code...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1000544
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1595625 (view as bug list)
Depends On: 1593006 1599941 1599942
Blocks: 1593003 1595629
TreeView+ depends on / blocked
 
Reported: 2018-06-19 20:19 UTC by Laura Pardo
Modified: 2019-09-29 14:42 UTC (History)
20 users (show)

Fixed In Version: rubyzip 1.2.2
Doc Type: If docs needed, set a value
Doc Text:
A directory and symbolic link traversal flaw was found in the way rubyzip gem extracts zip files. An attacker, with access to a privileged application capable of extracting zip files, could use this flaw to write new files to arbitrary paths, accessible by the aforementioned privileged application.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:29:38 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:3466 0 None None None 2018-11-05 13:58:34 UTC

Description Laura Pardo 2018-06-19 20:19:24 UTC 
A vulnerability has been found in the way developers have implemented the archive extraction of files. An arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar,xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder. Of course if an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily. This affects multiple libraries that lacks of a high level APIs that provide the archive extraction functionality.


References:
https://snyk.io/research/zip-slip-vulnerability
Comment 1 Laura Pardo 2018-06-19 20:31:41 UTC 
Created rubygem-rubyzip tracking bugs for this issue:

Affects: fedora-all [bug 1593006]
Comment 8 Tomas Hoger 2018-07-11 06:20:04 UTC 
Upstream bug:

https://github.com/rubyzip/rubyzip/issues/369

The issue has not been addressed upstream yet.
Comment 9 Richard Maciel Costa 2018-07-11 20:52:35 UTC 
*** Bug 1595625 has been marked as a duplicate of this bug. ***
Comment 14 errata-xmlrpc 2018-11-05 13:58:24 UTC 
This issue has been addressed in the following products:

  CloudForms Management Engine 5.9

Via RHSA-2018:3466 https://access.redhat.com/errata/RHSA-2018:3466
Note You need to log in before you can comment on or make changes to this bug.