Vulnerability Note VU#383779

ZIP archives containing files with large filenames can cause buffer overflows

Overview

Multiple file decompression utilities contain buffer overflow vulnerabilities for which the impacts vary.

I. Description

Researchers at Rapid7, Inc. have discovered that multiple file decompression utilities are susceptible to buffer overflows as a result of large filenames embedded in crafted ZIP archive files. When affected users attempt to decompress these ZIP files, the buffer overflow may result in execution of arbitrary code.

II. Impact

The impact of this vulnerability may vary depending upon the product and its execution environment. Typically, successful exploitation of a buffer overflow will allow the attacker to execute arbitrary code with the privileges of the user running the application.

III. Solution

Apply a patch

The vendor section of this document lists vendors who have been notified of this issue and their responses.

Systems Affected

Vendor	Status	Date Updated
3Com	Unknown	2-Oct-2002
Aladdin Systems Inc.	Vulnerable	2-Oct-2002
Alcatel	Unknown	2-Oct-2002
Apple Computer Inc.	Vulnerable	2-Oct-2002
BSDI	Unknown	2-Oct-2002
Cisco Systems Inc.	Unknown	2-Oct-2002
Compaq Computer Corporation	Unknown	2-Oct-2002
Computer Associates	Unknown	2-Oct-2002
Conectiva	Unknown	2-Oct-2002
Cray Inc.	Not Vulnerable	2-Oct-2002
Data General	Unknown	2-Oct-2002
Debian	Unknown	2-Oct-2002
F5 Networks	Unknown	2-Oct-2002
FreeBSD	Unknown	2-Oct-2002
Fujitsu	Not Vulnerable	2-Oct-2002
Guardian Digital Inc.	Unknown	2-Oct-2002
Hewlett-Packard Company	Unknown	2-Oct-2002
IBM	Not Vulnerable	8-Oct-2002
Intel	Unknown	2-Oct-2002
Internet Security Systems Inc.	Unknown	8-Oct-2002
Juniper Networks	Not Vulnerable	24-Oct-2002
Lachman	Unknown	2-Oct-2002
Lotus Development Corporation	Vulnerable	24-Oct-2002
Lucent	Unknown	2-Oct-2002
MandrakeSoft	Unknown	2-Oct-2002
Microsoft Corporation	Vulnerable	4-Oct-2002
MontaVista Software	Unknown	2-Oct-2002
Multinet	Unknown	2-Oct-2002
NEC Corporation	Not Vulnerable	2-Oct-2002
NetBSD	Unknown	2-Oct-2002
Network Appliance	Not Vulnerable	2-Oct-2002
Nortel Networks	Unknown	2-Oct-2002
OpenBSD	Unknown	2-Oct-2002
Openwall GNU/*/Linux	Not Vulnerable	4-Oct-2002
Oracle	Unknown	2-Oct-2002
Red Hat Inc.	Unknown	2-Oct-2002
Sequent	Unknown	2-Oct-2002
SGI	Unknown	2-Oct-2002
Sony Corporation	Unknown	2-Oct-2002
Sun Microsystems Inc.	Not Vulnerable	2-Oct-2002
SuSE Inc.	Unknown	2-Oct-2002
Symantec	Unknown	24-Oct-2002
The SCO Group (SCO Linux)	Not Vulnerable	2-Oct-2002
The SCO Group (SCO UnixWare)	Not Vulnerable	2-Oct-2002
Unisys	Unknown	2-Oct-2002
Wind River Systems Inc.	Unknown	2-Oct-2002
WinZip	Not Vulnerable	2-Oct-2002
Wirex	Unknown	2-Oct-2002
Xerox	Not Vulnerable	10-Dec-2002
zlib.org	Unknown	2-Oct-2002

References

http://www.rapid7.com/advisories/R7-0004.txt

Credit

This vulnerability was reported to the CERT/CC by Rapid7, Inc.

This document was written by Jeffrey P. Lanza.

Other Information

Date Public	10/02/2002
Date First Published	10/02/2002 04:06:40 PM
Date Last Updated	01/06/2003
CERT Advisory
CVE Name	CAN-2002-0370
Metric	20.25
Document Revision	22

If you have feedback, comments, or additional information about this vulnerability, please send us email.