Microsoft Windows zipped file decompression buffer overflow
| win-zip-decompression-bo (10251) |  High Risk |
Description:
Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP are vulnerable to a buffer overflow in the Compressed Folders feature, caused by improper bounds checking of file names when decompressing zipped files. By creating a zip file with a malformed file name in the archive, a remote attacker could overflow a buffer and execute arbitrary code on the victim's system or cause the system to crash, once the victim attempts to decompress the zipped file. An attacker could exploit this vulnerability by hosting the malicious file on a Web site or sending it to the victim as an email attachment.
Note: This vulnerability affects multiple vendor's file compression utilities. Refer to CERT Vulnerability Note VU#383779 for more information. See References.
Consequences:
Gain Access
Remedy:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS02-054. See References.
For Windows XP:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS04-034. See References.
Note: Microsoft originally provided a patch for this vulnerability in MS02-054, but it was superseded by the patch released with MS04-034. See References.
References:
- AppleCare Knowledge Base Document 61798: StuffIt Expander Security Update 2002-10-15. (Stuffit Expander: CAN-2002-0370. This update resolves a potential security vulnerability in versions 6.5.2 and earlier of Stuffit Expander.)
- CIAC Information Bulletin N-001: Microsoft File Decompression Functions Vulnerabilities.
- Microsoft Security Bulletin MS02-054: Unchecked Buffer in File Decompression Functions Could Lead to Code Execution (Q329048).
- Microsoft Security Bulletin MS04-034: Vulnerability in Compressed (zipped) Folders Could Allow Remote Code Execution (873376).
- Rapid 7, Inc. Security Advisory R7-0004: Multiple Vendor Long ZIP Entry Filename Processing Issues.
- BID-5870: Microsoft Windows 98/ME/XP File Decompression Vulnerabilities
- BID-5873: Multiple Vendor ZIP Files Long Filename Buffer Overflow Vulnerability
- BID-5876: Microsoft Compressed Folders Hostile Decompression Path Vulnerability
- CVE-2002-0370: Buffer overflow in the ZIP capability for multiple products allows remote attackers to cause a denial of service or execute arbitrary code via ZIP files containing entries with long filenames, including (1) Microsoft Windows 98 with Plus! Pack, (2) Windows XP, (3) Windows ME, (4) Lotus Notes R4 through R6 (pre-gold), (5) Verity KeyView, and (6) Stuffit Expander before 7.0.
- US-CERT VU#383779: ZIP archives containing files with large filenames can cause buffer overflows
Platforms Affected:
- Microsoft Windows 98 Plus Pack
- Microsoft Windows Me
- Microsoft Windows XP
Reported:
Oct 02, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net