unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.

The version of unzip installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2014-9636 advisory.

  - unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via     an extra field with an uncompressed size smaller than the compressed field size in a zip archive that     advertises STORED method compression. (CVE-2014-9636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - unzip: Heap-based buffer overflow in fileio.c:UzpPassword function allows code execution     (CVE-2018-1000035)

  - Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote     attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip     command. (CVE-2014-8139)

  - Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote     attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip     command. (CVE-2014-8140)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for unzip fixes the following issues :

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074)

This non-security issue was fixed :

+- Allow processing of Windows zip64 archives (Windows archivers set total_disks field to 0 but per standard, valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-15:Update update project.

This update for unzip fixes the following issues :

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unzip fixes the following security issues :

  - CVE-2014-9913: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013993)

  - CVE-2015-7696: Specially crafted zip files with password     protection could trigger a crash and lead to denial of     service (bsc#950110)

  - CVE-2015-7697: Specially crafted zip files could trigger     an endless loop and lead to denial of service     (bsc#950111)

  - CVE-2016-9844: Specially crafted zip files could trigger     invalid memory writes possibly resulting in DoS or     corruption (bsc#1013992)

  - CVE-2018-1000035: Prevent heap-based buffer overflow in     the processing of password-protected archives that     allowed an attacker to perform a denial of service or to     possibly achieve code execution (bsc#1080074).

  - CVE-2014-9636: Prevent denial of service (out-of-bounds     read or write and crash) via an extra field with an     uncompressed size smaller than the compressed field size     in a zip archive that advertises STORED method     compression (bsc#914442).

This non-security issue was fixed :

  - Allow processing of Windows zip64 archives (Windows     archivers set total_disks field to 0 but per standard,     valid values are 1 and higher) (bnc#910683)

This update was imported from the SUSE:SLE-12:Update update project.

This update for unzip fixes the following security issues :

CVE-2014-9913: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013993)

CVE-2015-7696: Specially crafted zip files with password protection could trigger a crash and lead to denial of service (bsc#950110)

CVE-2015-7697: Specially crafted zip files could trigger an endless loop and lead to denial of service (bsc#950111)

CVE-2016-9844: Specially crafted zip files could trigger invalid memory writes possibly resulting in DoS or corruption (bsc#1013992)

CVE-2018-1000035: Prevent heap-based buffer overflow in the processing of password-protected archives that allowed an attacker to perform a denial of service or to possibly achieve code execution (bsc#1080074).

CVE-2014-9636: Prevent denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression (bsc#914442).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201611-01 (UnZip: Multiple vulnerabilities)

    Multiple vulnerabilities were found in UnZip. Please review the       referenced CVE&rsquo;s for additional information.
  Impact :

    Remote attackers could execute arbitrary code or cause Denial of       Service.
  Workaround :

    There is no known workaround at this time.

unzip was updated to fix one security issue.

This security issue was fixed :

  - Out-of-bounds read/write in test_compr_eb() in extract.c     (CVE-2014-9636).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

A flaw was found in the test_compr_eb() function allowing out-of-bounds read and write access to memory locations. By carefully crafting a corrupt ZIP archive an attacker can trigger a heap overflow, resulting in application crash or possibly having other unspecified impact.

Additionally this update corrects a defective patch applied to address CVE-2014-8139, which caused a regression with executable jar files.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140     (CVE-2014-8141) Resolves: #1196132 #1196120 #1196124     #1196128

Updated unzip packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The unzip utility is used to list, test, or extract files from a zip archive.

A buffer overflow was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash or, possibly, execute arbitrary code when the archive was tested with unzip's '-t' option. (CVE-2014-9636)

A buffer overflow flaw was found in the way unzip computed the CRC32 checksum of certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8139)

An integer underflow flaw, leading to a buffer overflow, was found in the way unzip uncompressed certain extra fields of a file. A specially crafted Zip archive could cause unzip to crash when the archive was tested with unzip's '-t' option. (CVE-2014-8140)

A buffer overflow flaw was found in the way unzip handled Zip64 files.
A specially crafted Zip archive could possibly cause unzip to crash when the archive was uncompressed. (CVE-2014-8141)

Red Hat would like to thank oCERT for reporting the CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141 issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter of these issues.

All unzip users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 6 / 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2015-0700 advisory.

    [6.0-2]
    - Fix CVE-2014-9636 CVE-2014-8139 CVE-2014-8140 CVE-2014-8141       Resolves: #1196132 #1196120 #1196124 #1196128

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes the following security issues :

  - input sanitization errors. (bnc#909214). (CVE-2014-8139)

  - out-of-bounds read/write in test_compr_eb()     (bnc#914442). (CVE-2014-9636)

- Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - CVE-2014-9636 unzip: out-of-bounds read/write in     test_compr_eb() in extract.c - re-fix (see     https://bugzilla.redhat.com/show_bug.cgi?id=1184985#c7)

    - Fix CVE-2014-8139 - CRC32 verification heap-based       buffer overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

  - Fix CVE-2014-8139 - CRC32 verification heap-based buffer     overread (#1174844)

  - Fix CVE-2014-8140 - out-of-bounds write issue in     test_compr_eb() (#1174851)

  - Fix CVE-2014-8141 - getZip64Data() out-of-bounds read     issues (#1174856)

  - Fix buffer overflow on long file sizes (#1191136)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2489-1 advisory.

    Michal Zalewski discovered that unzip incorrectly handled certain malformed zip archives. If a user or     automated system were tricked into processing a specially crafted zip archive, an attacker could possibly     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Ubuntu Security Notice USN-2489-1 reports :

Michal Zalewski discovered that unzip incorrectly handled certain malformed zip archives. If a user or automated system were tricked into processing a specially crafted zip archive, an attacker could possibly execute arbitrary code.

A flaw was found in the test_compr_eb() function allowing out-of-bounds read and write access to memory locations. By carefully crafting a corrupt ZIP archive an attacker can trigger a heap overflow, resulting in application crash or possibly having other unspecified impact.

Security fix for CVE-2014-9636

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated unzip package fix security vulnerabilities :

The unzip command line tool is affected by heap-based buffer overflows within the CRC32 verification (CVE-2014-8139), the test_compr_eb() (CVE-2014-8140) and the getZip64Data() (CVE-2014-8141) functions. The input errors may result in in arbitrary code execution. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the vulnerability.

OOB access (both read and write) issues also exist in test_compr_eb() that can result in application crash or other unspecified impact. A specially crafted zip file, passed to the command unzip -t, can be used to trigger the issues (CVE-2014-9636).

ID	Name	Product	Family	Severity
201261	CBL Mariner 2.0 Security Update: unzip (CVE-2014-9636)	Nessus	MarinerOS Local Security Checks	high
199562	RHEL 5 : unzip (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
123214	openSUSE Security Update : unzip (openSUSE-2019-509)	Nessus	SuSE Local Security Checks	high
120030	SUSE SLED15 / SLES15 Security Update : unzip (SUSE-SU-2018:1883-1)	Nessus	SuSE Local Security Checks	high
117981	openSUSE Security Update : unzip (openSUSE-2018-1124)	Nessus	SuSE Local Security Checks	high
117902	SUSE SLED12 / SLES12 Security Update : unzip (SUSE-SU-2018:2978-1)	Nessus	SuSE Local Security Checks	high
110965	openSUSE Security Update : unzip (openSUSE-2018-709)	Nessus	SuSE Local Security Checks	high
94460	GLSA-201611-01 : UnZip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
83688	SUSE SLED12 / SLES12 Security Update : unzip (SUSE-SU-2015:0355-1)	Nessus	SuSE Local Security Checks	medium
82832	Amazon Linux AMI : unzip (ALAS-2015-504)	Nessus	Amazon Linux Local Security Checks	high
82263	Scientific Linux Security Update : unzip on SL6.x, SL7.x i386/x86_64 (20150318)	Nessus	Scientific Linux Local Security Checks	high
82133	Debian DLA-150-1 : unzip security update	Nessus	Debian Local Security Checks	high
81968	OracleVM 3.3 : unzip (OVMSA-2015-0037)	Nessus	OracleVM Local Security Checks	high
81949	RHEL 6 / 7 : unzip (RHSA-2015:0700)	Nessus	Red Hat Local Security Checks	high
81947	Oracle Linux 6 / 7 : unzip (ELSA-2015-0700)	Nessus	Oracle Linux Local Security Checks	high
81925	CentOS 6 / 7 : unzip (CESA-2015:0700)	Nessus	CentOS Local Security Checks	high
81543	SuSE 11.3 Security Update : unzip (SAT Patch Number 10344)	Nessus	SuSE Local Security Checks	medium
81542	SuSE 11.3 Security Update : unzip (SAT Patch Number 10344)	Nessus	SuSE Local Security Checks	medium
81454	Fedora 20 : unzip-6.0-17.fc20 (2015-1993)	Nessus	Fedora Local Security Checks	medium
81367	Fedora 21 : unzip-6.0-20.fc21 (2015-2035)	Nessus	Fedora Local Security Checks	medium
81162	Ubuntu 14.04 LTS : unzip vulnerability (USN-2489-1)	Nessus	Ubuntu Local Security Checks	high
81154	FreeBSD : unzip -- out of boundary access issues in test_compr_eb (e543c6f8-abf2-11e4-8ac7-d050992ecde8)	Nessus	FreeBSD Local Security Checks	medium
81149	Debian DSA-3152-1 : unzip - security update	Nessus	Debian Local Security Checks	medium
81095	Fedora 20 : unzip-6.0-15.fc20 (2015-1267)	Nessus	Fedora Local Security Checks	medium
81061	Fedora 21 : unzip-6.0-18.fc21 (2015-1189)	Nessus	Fedora Local Security Checks	medium
80435	Mandriva Linux Security Advisory : unzip (MDVSA-2015:016)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2014-9636

high

Tenable Plugins

high

high

high

high

high

high

high

high

medium

high

high

high

high

high

high

high

medium

medium

medium

medium

high

medium

medium

medium

medium

medium