SB2018073110 - Remote code execution in QuaZIP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018073110

SB2018073110 - Remote code execution in QuaZIP

Published: July 31, 2018

Security Bulletin ID SB2018073110
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Path traversal (CVE-ID: CVE-2018-1002209)

The vulnerability allows a remote attacker to conduct a directory traversal attack on the target system.

The vulnerability exists in the extractDir() function of QuaZIP due to improper validation of files inside an archive file. A remote unauthenticated attacker can trick the victim into extracting an archive file that contains a file using directory traversal characters, and cause the service to crash or execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note: This vulnerability is also known as 'Zip-Slip'.


Remediation

Install update from vendor's website.

References