[unzip] [CVE-2008-0888] potential code execution

[disabled.user]

Binary package hint: unzip

References:
DSA 1522-1 (http://www.debian.org/security/2008/dsa-1522)

Quoting:
"Tavis Ormandy discovered that unzip, when processing specially crafted
ZIP archives, could pass invalid pointers to the C library's free
routine, potentially leading to arbitrary code execution"

[Tomas (tomas-redhat-bugs)]

Tavis Ormandy has discovered a flaw in unzip that can cause unzip to attempt to
free() memory block pointed to by uninitialized pointer or memory block, which
was already freed. This can cause unzip to crash (SEGV) during extraction of
malicious zip file, possibly allowing code execution.

Further details from Tavis:

  the inflate_dynamic() routine (~978, inflate.c) uses a macro
  NEEDBITS() that jumps execution to a cleanup routine on error, this
  routine attempts to free() two buffers allocated during the inflate
  process. At certain locations, the NEEDBITS() macro is used while the
  pointers are not pointing to valid buffers, they are either
  uninitialised or pointing inside a block that has already been free()d
  (ie, not pointing at the block, but at a location inside it).

Acknowledgements:

Red Hat would like to thank Tavis Ormandy of the Google Security Team for reporting this issue.

[Tomas (tomas-redhat-bugs)]

Created attachment 293893
Patch against 5.5.2 proposed by Tavis

[Josh (josh-redhat-bugs)]

This flaw is a crash only on Red Hat Enterprise Linux 4 and 5, as glibc will not
allow a free on an invalid pointer.

[rbu (rbu-gentoo-bugs)]

Tavis Ormandy writes:

the inflate_dynamic() routine (~978, inflate.c) uses a macro
NEEDBITS() that jumps execution to a cleanup routine on error, this
routine attempts to free() two buffers allocated during the inflate
process. At certain locations, the NEEDBITS() macro is used while the
pointers are not pointing to valid buffers, they are either
uninitialised or pointing inside a block that has already been free()d
(ie, not pointing at the block, but at a location inside it).

In both cases, the possibility of controlling either the pointer (eg,
by altering the unitialized data on the stack left over from some
previous subroutine call), or the buffer pointed at by the pointer, is
small but perhaps non-zero.

[rbu (rbu-gentoo-bugs)]

base-system, please find the patch attached. No upstream bump to be expected, smithj tried contacting them without success.

[rbu (rbu-gentoo-bugs)]

Created attachment 146443
unzip-5.5.2-CVE-2008-0888.patch

Courtesy of Tavis

[smithj (smithj-gentoo-bugs)]

(In reply to comment #1)
> smithj tried contacting them without success.

Yeah. Actually, if anyone has a contact for them, please pass this info along!

[Tomas (tomas-redhat-bugs)]

Public now:

http://taviso.decsystem.org/research.html
https://issues.rpath.com/browse/RPL-2317
http://marc.info/?l=full-disclosure&m=120579856512587&w=4

[Tomas (tomas-redhat-bugs)]

Issue is also caught on Fedora 7/8 by malloc/free checks, only causing client
application DoS, which is not considered a security issue. I've filed tracking
bug for rawhide, so that this issue is addressed in future Fedora and Red Hat
Enterprise Linux versions.

[vapier (vapier-gentoo-bugs)]

i'd drop the last two hunks of that patch as one is simply whitespace change and the other is redundant -- huft_free() already performs the if(NULL) test

[rbu (rbu-gentoo-bugs)]

(In reply to comment #4)
> i'd drop the last two hunks of that patch as one is simply whitespace change
> and the other is redundant -- huft_free() already performs the if(NULL) test

sounds good, taviso complained about losing performance though ;-)

[Kees Cook (kees)]

Thanks for the report. This update will be published shortly.

[Kees Cook (kees)]

Thanks, this was published as: http://www.ubuntu.com/usn/usn-589-1

[rbu (rbu-gentoo-bugs)]

spanky, any updates here?

[vapier (vapier-gentoo-bugs)]

added unzip-5.5.2-r2 to the tree w/the patch ... not that i really looked into the issue to verify correctness of the patch

[rbu (rbu-gentoo-bugs)]

(In reply to comment #7)
> added unzip-5.5.2-r2 to the tree w/the patch ... not that i really looked into
> the issue to verify correctness of the patch

Couldn't reproduce the error with taviso's PoC.

[rbu (rbu-gentoo-bugs)]

Arches, please test and mark stable:
=app-arch/unzip-5.52-r2
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 release s390 sh sparc x86"

[rbu (rbu-gentoo-bugs)]

amd64 stable

[fauli (fauli-gentoo-bugs)]

x86 stable

[ranger (ranger-gentoo-bugs)]

ppc and ppc64 done

[armin76 (armin76-gentoo-bugs)]

alpha/ia64/sparc stable

[jer (jer-gentoo-bugs)]

Stable for HPPA.

[pva (pva-gentoo-bugs)]

Fixed in release snapshot.

[rbu (rbu-gentoo-bugs)]

GLSA 200804-06.

[Red (red-redhat-bugs)]

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0196.html