Junglewise Threat Intelligence

CVE-2014-9913: Info-Zip UnZip buffer overflow in list_files

CVE-2014-9913 · Severity: medium · CVSS 4 · Published 2017-01-18

Technologies: Unzip Project Unzip. Vendors: Unzip Project.

Executive brief

A vulnerability in the Info-Zip UnZip utility could allow an attacker to crash the application. This occurs when the tool processes a specially crafted ZIP file with an unusual compression method value. While primarily a stability issue, it could disrupt automated workflows or services that rely on UnZip to process uploaded files.

Technical details

A stack-based buffer overflow exists in the list_files function within list.c of Info-Zip UnZip 6.0. The vulnerability is triggered when the program uses sprintf to write a compression method ID into a fixed-size 8-byte buffer (methbuf). Because the %03u format specifier does not limit the output length, a compression method value exceeding 999 (which can be up to 65535 in a 2-byte field) results in a buffer overflow. An attacker can exploit this by providing a malicious ZIP file, leading to a denial of service or potentially affecting other local variables on the stack. This issue is closely related to a similar overflow in zipinfo.c (CVE-2016-9844).

Affected products

  • Info-Zip UnZip 6.0

Timeline

  • 2014-11-03: disclosed: Initial discovery and public post to oss-security mailing list.
  • 2017-01-18: advisory: NVD published the CVE record.

References

Related threats