Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.

The version of unzip installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2014-8140 advisory.

  - Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote     attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip     command. (CVE-2014-8140)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - unzip: Heap-based buffer overflow in fileio.c:UzpPassword function allows code execution     (CVE-2018-1000035)

  - Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote     attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip     command. (CVE-2014-8139)

  - Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote     attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip     command. (CVE-2014-8140)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

An update of the unzip package has been released.

New infozip packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201611-01 (UnZip: Multiple vulnerabilities)

    Multiple vulnerabilities were found in UnZip. Please review the       referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could execute arbitrary code or cause Denial of       Service.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.4 and the following components contain vulnerabilities :

  - Admin Framework 
-  afpserver 
 - apache 
 - AppleFSCompression 
 - AppleGraphicsControl 
 - AppleThunderboltEDMService 
 - ATS 
 - Bluetooth 
 - Certificate Trust Policy 
 - CFNetwork HTTPAuthentication 
 - CoreText 
 - coreTLS 
 - DiskImages 
 - Display Drivers 
 - EFI 
 - FontParser 
 - Graphics Driver 
 - ImageIO 
 - Install Framework Legacy 
 - Intel Graphics Driver 
 - IOAcceleratorFamily 
 - IOFireWireFamily 
 - Kernel 
 - kext tools 
 - Mail 
 - ntfs 
 - ntp 
 - OpenSSL 
 - QuickTime 
 - Security 
 - Spotlight 
 - SQLite 
 - System Stats 
 - TrueTypeScaler 
 - zip

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Updated unzip package fix security vulnerabilities :

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues.

Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139), the test_compr_eb() function (CVE-2014-8140) and the getZip64Data() function (CVE-2014-8141), which may lead to the execution of arbitrary code.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140     (CVE-2014-8141) Resolves: #1196132 #1196120 #1196124     #1196128

Updated unzip packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The unzip utility is used to list, test, or extract files from a zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter of these issues.

All unzip users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-0700 advisory.

    [6.0-2]
    - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141       Resolves: #1196132 #1196120 #1196124 #1196128

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - CVE-2014-9636 unzip: out-of-bounds read/write in     test_compr_eb() in extract.c - re-fix (see     https://bugzilla.redhat.com/show_bug.cgi?id=1184985#c7)

    - Fix CVE-2014-8139 - CRC32 verification heap-based       buffer overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

unzip was updated to fix security issues.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() functions (CVE-2014-8141). The input errors may result in in arbitrary code execution.

More info can be found in the oCert announcement:
http://seclists.org/oss-sec/2014/q4/1127

This update fixes the following security issues :

  - heap overflow condition in the CRC32 verification.
    (CVE-2014-8139)

  - write error (_8349_) shows a problem in     extract.c:test_compr_eb(). (CVE-2014-8140)

  - read errors (_6430_, _3422_) show problems in     process.c:getZip64Data(). (CVE-2014-8141)

oCERT reports :

The UnZip tool is an open source extraction utility for archives compressed in the zip format.

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification, the test_compr_eb() and the getZip64Data() functions. The input errors may result in arbitrary code execution.

A specially crafted zip file, passed to unzip -t, can be used to trigger the vulnerability.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2472-1 advisory.

    Wolfgang Ettlinger discovered that unzip incorrectly handled certain malformed zip archives. If a user or     automated system were tricked into processing a specially crafted zip archive, an attacker could possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated unzip package fix security vulnerabilities :

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues (CVE-2014-9636).

Michele Spagnuolo of the Google Security Team discovered that unzip, an extraction utility for archives compressed in .zip format, is affected by heap-based buffer overflows within the CRC32 verification function (CVE-2014-8139 ), the test_compr_eb() function (CVE-2014-8140 ) and the getZip64Data() function (CVE-2014-8141 ), which may lead to the execution of arbitrary code.

ID	Name	Product	Family	Severity
201707	CBL Mariner 2.0 Security Update: unzip (CVE-2014-8140)	Nessus	MarinerOS Local Security Checks	high
199562	RHEL 5 : unzip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
134423	Photon OS 2.0: Unzip PHSA-2020-2.0-0213	Nessus	PhotonOS Local Security Checks	high
134212	Photon OS 3.0: Unzip PHSA-2020-3.0-0063	Nessus	PhotonOS Local Security Checks	high
134208	Photon OS 1.0: Unzip PHSA-2020-1.0-0281	Nessus	PhotonOS Local Security Checks	high
122576	Slackware 14.0 / 14.1 / 14.2 / current : infozip (SSA:2019-060-01)	Nessus	Slackware Local Security Checks	high
94460	GLSA-201611-01 : UnZip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
8801	Mac OS X < 10.10.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
85950	F5 Networks BIG-IP : Multiple unzip vulnerabilities (SOL16480)	Nessus	F5 Networks Local Security Checks	high
82832	Amazon Linux AMI : unzip (ALAS-2015-504)	Nessus	Amazon Linux Local Security Checks	high
82376	Mandriva Linux Security Advisory : unzip (MDVSA-2015:123)	Nessus	Mandriva Local Security Checks	high
82263	Scientific Linux Security Update : unzip on SL6.x, SL7.x i386/x86_64 (20150318)	Nessus	Scientific Linux Local Security Checks	high
82107	Debian DLA-124-1 : unzip security update	Nessus	Debian Local Security Checks	high
81968	OracleVM 3.3 : unzip (OVMSA-2015-0037)	Nessus	OracleVM Local Security Checks	high
81949	RHEL 6 / 7 : unzip (RHSA-2015:0700)	Nessus	Red Hat Local Security Checks	high
81947	Oracle Linux 6 / 7 : unzip (ELSA-2015-0700)	Nessus	Oracle Linux Local Security Checks	high
81925	CentOS 6 / 7 : unzip (CESA-2015:0700)	Nessus	CentOS Local Security Checks	high
81454	Fedora 20 : unzip-6.0-17.fc20 (2015-1993)	Nessus	Fedora Local Security Checks	medium
81367	Fedora 21 : unzip-6.0-20.fc21 (2015-2035)	Nessus	Fedora Local Security Checks	medium
81252	openSUSE Security Update : unzip (openSUSE-2015-119)	Nessus	SuSE Local Security Checks	high
80825	SuSE 11.3 Security Update : unzip (SAT Patch Number 10159)	Nessus	SuSE Local Security Checks	high
80577	FreeBSD : unzip -- input sanitization errors (d9360908-9d52-11e4-87fd-10bf48e1088e)	Nessus	FreeBSD Local Security Checks	high
80551	Ubuntu 14.04 LTS : unzip vulnerabilities (USN-2472-1)	Nessus	Ubuntu Local Security Checks	high
80435	Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)	Nessus	Mandriva Local Security Checks	medium
80255	Debian DSA-3113-1 : unzip - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-8140

high

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

medium

medium

high

high

high

high

medium

high