Info-ZIP UnZip CVE-2018-1000033 Out of Bounds Denial of Service Vulnerability

Bugtraq ID:	103031
Class:	Boundary Condition Error
CVE:	CVE-2018-1000033
Remote:	Yes
Local:	No
Published:	Feb 07 2018 12:00AM
Updated:	Feb 07 2018 12:00AM
Credit:	R. Freingruber
Vulnerable:	Info-ZIP UnZip 6.10c22
Not Vulnerable:	Info-ZIP UnZip 6.10c23

Info-ZIP UnZip CVE-2018-1000033 Out of Bounds Denial of Service Vulnerability

Info-ZIP UnZip is prone to a denial-of-service vulnerability.

Successful exploits will allow an attacker to crash the application resulting in a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible, but has not been confirmed.

Info-ZIP UnZip CVE-2018-1000033 Out of Bounds Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Info-ZIP UnZip CVE-2018-1000033 Out of Bounds Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Info-ZIP UnZip CVE-2018-1000033 Out of Bounds Denial of Service Vulnerability

References:

• Bug 1537062 - (CVE-2018-1000033) CVE-2018-1000033 unzip: Heap-based out-of-bound (Redhat)
  
• CVE-2018-1000033 (Redhat)
  
• MULTIPLE BUFFER OVERFLOW VULNERABILITIES IN INFOZIP UNZIP (SEC Consult)
  
• UnZip Homepgae (Info-ZIP)