Multiple vulnerabilities in ZZIPlib

Published: 2018-09-08 | Updated: 2020-05-04

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-16548 CVE-2018-17828
CWE-ID	CWE-401 CWE-22
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software Subscribe	ZZIPlib Universal components / Libraries / Libraries used by multiple products
Vendor	zziplib.sourceforge.net

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated: 04.05.2020

Changed bulletin status to patched, added vulnerability #2, raised bulletin severity rating to medium.

1) Memory leak

EUVDB-ID: #VU14700

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:U/RC:C]

CVE-ID: CVE-2018-16548

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The vulnerability exists due to a memory leak in the __zzip_parse_root_directory function, as defined in the zip.c source code file. A local attacker can supply specially crafted input and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ZZIPlib: 0.13.0 - 0.13.69

External links

http://github.com/gdraheim/zziplib/issues/58

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Path traversal

EUVDB-ID: #VU27504

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-17828

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in ZZIPlib within the unzzip_cat() function in the bins/unzzipcat-mem.c. A remote attacker can pass specially crafted archive to the application and overwrite arbitrary files on the system.