Vulnerability Note VU#649374

Microsoft Windows processing of zip files contains a buffer overflow

A remote code execution vulnerability exists in Compressed (zipped) Folders because of an unchecked buffer in the way that it handles specially crafted compressed files. An attacker could exploit the vulnerability by constructing a malicious compressed file that could potentially allow remote code execution if a user visited a malicious Web site. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability.

Apply a patch as described in Microsoft Security Bulletin MS04-034. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

Do Not Accept Zip Files from Untrusted Sources

Exploitation occurs by accessing a specially crafted zip file (.zip extension). By only accessing zip files from trusted or known sources, the chances of exploitation are reduced.

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-034.

Systems Affected

http://www.microsoft.com/technet/security/bulletin/MS04-034.mspx
http://securitytracker.com/alerts/2004/Oct/1011637.html

Credit

Microsoft has published Microsoft Security Bulletin MS04-034 to address this vulnerability.

Microsoft credits eEye Digital Security for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.