[NT] WinZip Multiple Buffer Overflows

From: SecuriTeam (support_at_securiteam.com)
Date: 09/06/04

  • Next message: SecuriTeam: "[UNIX] TorrentTrader SQL Injection" 
    To: list@securiteam.com
Date: 6 Sep 2004 13:02:24 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      WinZip Multiple Buffer Overflows
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.winzip.com/> WinZip is an archiving utility for the Microsoft
    Windows platform featuring built-in support for CAB files and for popular
    Internet file formats such as TAR, gzip, UUencode, BinHex, and MIME. ARJ,
    LZH, and ARC files are supported via external programs.

    New vulnerabilities were found in WinZip, including buffer overflows in
    various portions of code and in command line argument parsing. The
    vulnerabilities in question can easily lead to arbitrary code execution.

    DETAILS

    Vulnerable Systems:
     * WinZip versions 9.0 and prior

    Immune Systems:
     * WinZip version 9.0 SR-1

    A few unspecified buffer overflows were found in WinZip while performing
    an internal code audit. Another buffer overflow was found when a specially
    crafted command line was used.

    Impact
    Zip files are used almost everywhere and are extremely widespread.
    Considering this and the fact that almost any Win32 based system contains
    a vulnerable version of WinZip, almost every system is prone to attack.
    All an attacker has to do is to either exploit one of the overflow
    conditions inherent in the code by providing a special zip file or by
    somehow launching winzip with a specially crafted command line. Both of
    these attacks are very possible and pose a serious threat to any Windows
    users.

    Vendor Status:
    The vendor has been contacted and a fix is already available for download
    at <http://www.winzip.com/upgrade.htm> http://www.winzip.com/upgrade.htm.
    Users of WinZip are highly encouraged to upgrade their WinZip version to
    the newer, immune version.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:toounrealuk@hotmail.com>
    Matt H.
    The original article can be found at:
    <http://www.securitytracker.com/alerts/2004/Sep/1011132.html>
    http://www.securitytracker.com/alerts/2004/Sep/1011132.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] TorrentTrader SQL Injection"

    Relevant Pages

    • [NT] WinZip MIME Parsing Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WinZip is an archiving utility for the Microsoft ... A buffer overflow vulnerability exists in WinZip and allows arbitrary code ... parameters of MIME archives. ...
      (Securiteam)
    • [EXPL] WinZip MIME Parsing Buffer Overflow Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... a vulnerability in WinZip allows an attacker to ... "\x55" // push ebp ... "\x33\xf6" // xor esi, esi ...
      (Securiteam)
    • [NT] CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... CA ARCServe Backup for Laptops and Desktops Multiple Buffer Overflow ... Remote exploitation of multiple buffer overflow vulnerabilities in ... rxsGetSubDirs, rxsGetServerDBPathName, rxsSetServerOptions, rxsDeleteFile, ...
      (Securiteam)
    • [NT] Novell eDirectory Multiple Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell eDirectory Multiple Vulnerabilities ... Three different vulnerabilities were discovered in Novell's eDirectory ... NCP over IP length Heap Overflow: ...
      (Securiteam)
    • [NEWS] Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick DCM and XWD Buffer Overflow Vulnerabilities ...
      (Securiteam)