Executive brief
A vulnerability in the Info-ZIP UnZip utility, a common tool for extracting compressed files, could allow an attacker to crash the application. By providing a specially crafted ZIP file with a large compression method value, an attacker can trigger a buffer overflow. This results in a denial-of-service condition where the tool fails to process the file and terminates unexpectedly.
Technical details
A buffer overflow exists in Info-ZIP UnZip 6.0 within the zi_short() function in zipinfo.c. The vulnerability is triggered when the two-byte compression method field in a ZIP file's central directory file header contains a value greater than 999. The code uses sprintf() to write this value into a 5-byte buffer (methbuf) starting at an offset of 1 byte. When the value is 1000 or greater, the resulting string (including the null terminator) exceeds the buffer bounds. This is a local attack vector requiring the victim to process a malicious ZIP file using the zipinfo tool. A fix was proposed for version 6.1e beta.
Affected products
- Info-ZIP UnZip 6.0
Timeline
- 2016-11-22: disclosed: Vulnerability reported to Ubuntu by Alexis Vanden Eijnde.
- 2016-12-05: other: CVE-2016-9844 assigned.
- 2017-01-18: advisory: NVD published the vulnerability.