Heap-based buffer overflow in UnZip - CVE-2022-0530

Vulnerability identifier: #VU63289

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-0530

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

UnZip
Debian Linux
Oracle Solaris
Amazon Linux AMI
Gentoo Linux
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Storage
macOS
SUSE Linux Enterprise Server
Ubuntu
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Module for Basesystem
openSUSE Leap
openEuler
Anolis OS
Dell Data Protection Central
Dell EMC PowerProtect Data Protection
cflinuxfs3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
RecoverPoint for Virtual Machines
IBM Tivoli Application Dependency Discovery Manager
unzip (Ubuntu package)
unzip-doc
unzip
unzip (Debian package)
unzip-debuginfo
unzip-debugsource
unzip-help
RSA Authentication Manager

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Oracle Solaris - update to 11.4 SRU 71
cflinuxfs3 - update to 0.328.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
IBM Tivoli Application Dependency Discovery Manager - update to 7.3.0.10
macOS - addressed in versions 10.15.7 19H1922, 11.6.6 20G624, 12.4 21F79
unzip (Ubuntu package) - addressed in versions Ubuntu Pro (Infra-only), 6.0-21ubuntu1.2, 6.0-25ubuntu1.1, 6.0-26ubuntu3.1
unzip-doc - update to 6.0-5
unzip - update to 6.0-5
unzip (Debian package) - update to 6.0-26+deb11u1
unzip - addressed in versions 6.00-33.16.1, 6.00-150000.4.11.1
unzip-debuginfo - addressed in versions 6.00-33.16.1, 6.00-150000.4.11.1
unzip-debugsource - addressed in versions 6.00-33.16.1, 6.00-150000.4.11.1
unzip-debugsource - update to 6.0-46
unzip-debuginfo - update to 6.0-46
unzip-help - update to 6.0-46
unzip - update to 6.0-46
unzip - update to 6.0-57
unzip-doc - update to 6.00-150000.4.11.1
RSA Authentication Manager - update to 8.7 Patch 2

• Exploit #8232 - unzip_poc (CVE-2022-0529 & CVE-2022-0530) (August 9, 2022)

• https://bugzilla.redhat.com/show_bug.cgi?id=2051395
• https://github.com/ByteHackr/unzip_poc

• Remote code execution in Unzip
• Multiple vulnerabilities in Apple macOS Monterey
• Multiple vulnerabilities in Apple macOS Big Sur
• Multiple vulnerabilities in Apple macOS Catalina
• Debian update for unzip
• SUSE update for unzip
• SUSE update for unzip
• Ubuntu update for unzip
• Multiple vulnerabilities in cflinuxfs3
• Multiple vulnerabilities in Dell EMC Data Protection Central
• Multiple vulnerabilities in IBM Tivoli Application Dependency Discovery Manager
• Gentoo update for UnZip
• openEuler update for unzip
• Amazon Linux AMI update for unzip
• Oracle Solaris update for thrid-party components
• RSA Authentication Manager update for third-party components
• Dell RecoverPoint for Virtual Machines update for third-party components
• Anolis OS update for unzip
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge