CVE-2014-8139: Buffer Overflow
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
Other sources
oCERT reports unzip flaw discovered by Michele Spagnuolo, Google Security Team.
""" I would like to report a heap overflow condition in the CRC32 verification of unzip, which may result in arbitrary code execution.
It can be triggered by passing a maliciously crafted zip files to unzip -t (version 6.00, both InfoZip and Debian).
Patches:
The problem was an unrealistic/invalid value in a .ZIP Extra Field. There was a check (in extract.c:TestExtraField()) for an extra-block length that was too large, but no check for a too-small value. In this example, the length (ebLen) was 1, and when "(ebLen-4)" was passed to crc32(), bad things happened.
A revised extract.c (which adds a new check and error message) should be available here:
http://antinode.info/ftp/unzip60/extract.c """
Acknowledgement:
Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8139?
CVE-2014-8139 has a severity rating of high due to the potential for remote code execution.
How do I fix CVE-2014-8139?
To fix CVE-2014-8139, update the Info-ZIP UnZip software to version 6.0 or later.
What systems are affected by CVE-2014-8139?
CVE-2014-8139 affects Info-ZIP UnZip 6.0 and earlier, as well as various versions of Red Hat Enterprise Linux.
Can CVE-2014-8139 be exploited remotely?
Yes, CVE-2014-8139 can be exploited remotely through a crafted zip file passed to the unzip command.
What type of vulnerability is CVE-2014-8139?
CVE-2014-8139 is a heap-based buffer overflow vulnerability.