REDHAT-BUG-1174844: Low severity InfoZip unzip vulnerability

oCERT reports unzip flaw discovered by Michele Spagnuolo, Google Security Team.

""" I would like to report a heap overflow condition in the CRC32 verification of unzip, which may result in arbitrary code execution.

It can be triggered by passing a maliciously crafted zip files to unzip -t (version 6.00, both InfoZip and Debian).

Patches:

The problem was an unrealistic/invalid value in a .ZIP Extra Field. There was a check (in extract.c:TestExtraField()) for an extra-block length that was too large, but no check for a too-small value. In this example, the length (ebLen) was 1, and when "(ebLen-4)" was passed to crc32(), bad things happened.

A revised extract.c (which adds a new check and error message) should be available here:

http://antinode.info/ftp/unzip60/extract.c """

Acknowledgement:

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.