#VU13613 Out-of-bounds read in UnZip


Published: 2018-07-07 | Updated: 2018-07-09

Vulnerability identifier: #VU13613

Vulnerability risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-9636

CWE-ID: CWE-125

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
UnZip
Client/Desktop applications / Software for archiving

Vendor: Info-ZIP

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to out-of-bounds read when handling malicious input. A remote attacker can supply extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression and cause the service to crash.

Mitigation
Install update from vendor's website.

Vulnerable software versions

UnZip: 6.0

External links
http://infozip.sourceforge.net/phpBB3/viewtopic.php?f=7&t=450

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


OpenSUSE Linux update for unzip
Out-of-bounds read in unzip (Alpine package)
OpenSUSE Linux update for unzip
Gentoo update for UnZip
Amazon Linux AMI update for unzip