Is CVE-2014-9913 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2014-9913 being exploited in the wild.

How severe is CVE-2014-9913?

Medium severity, with a CVSS score of 4, published 18 January 2017.

Is there a fix for CVE-2014-9913?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2014-9913 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2014-9913?

Check whether you run Unzip Project Unzip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2014-9913: Info-Zip UnZip buffer overflow in list_files

CVE-2014-9913 · Severity: medium · CVSS 4 · Published 2017-01-18

A vulnerability in the Info-Zip UnZip utility could allow an attacker to crash the application. This occurs when the tool processes a specially crafted ZIP file with an unusual compression method value. While primarily a stability issue, it could disrupt automated workflows or services that rely on UnZip to process uploaded files.

Technologies: Unzip Project Unzip. Vendors: Unzip Project.

Quick answers

Is CVE-2014-9913 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2014-9913 being exploited in the wild.
How severe is CVE-2014-9913?: Medium severity, with a CVSS score of 4, published 18 January 2017.
Which products and versions are affected?: Info-Zip UnZip 6.0.
Is there a fix for CVE-2014-9913?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2014-9913 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2014-9913?: Check whether you run Unzip Project Unzip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow exists in the list_files function within list.c of Info-Zip UnZip 6.0. The vulnerability is triggered when the program uses sprintf to write a compression method ID into a fixed-size 8-byte buffer (methbuf). Because the %03u format specifier does not limit the output length, a compression method value exceeding 999 (which can be up to 65535 in a 2-byte field) results in a buffer overflow. An attacker can exploit this by providing a malicious ZIP file, leading to a denial of service or potentially affecting other local variables on the stack. This issue is closely related to a similar overflow in zipinfo.c (CVE-2016-9844).

Affected products

Info-Zip UnZip 6.0

Timeline

2014-11-03: disclosed: Initial discovery and public post to oss-security mailing list.
2017-01-18: advisory: NVD published the CVE record.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.