Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
BID:11382
Info
Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
| Bugtraq ID: | 11382 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-0575 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 12 2004 12:00AM |
| Updated: | Jul 12 2009 07:06AM |
| Credit: | Discovery is credited to eEye Digital Security. |
| Vulnerable: |
RealNetworks RealPlayer 10.5 v6.0.12.1053 RealNetworks RealPlayer 10.5 v6.0.12.1040 RealNetworks RealPlayer 10.5 Beta v6.0.12.1016 RealNetworks RealPlayer 10.0 RealNetworks RealOne Player 2.0 RealNetworks RealOne Player 1.0 Microsoft Windows XP Tablet PC Edition Microsoft Windows XP Professional SP1 Microsoft Windows XP Professional Microsoft Windows XP Media Center Edition SP1 Microsoft Windows XP Media Center Edition Microsoft Windows XP Home SP1 Microsoft Windows XP Home Microsoft Windows XP 64-bit Edition Version 2003 SP1 Microsoft Windows XP 64-bit Edition Version 2003 Microsoft Windows XP 64-bit Edition SP1 Microsoft Windows XP 64-bit Edition Microsoft Windows Server 2003 Web Edition Microsoft Windows Server 2003 Standard Edition Microsoft Windows Server 2003 Enterprise Edition Itanium 0 Microsoft Windows Server 2003 Enterprise Edition Microsoft Windows Server 2003 Datacenter Edition Itanium 0 Microsoft Windows Server 2003 Datacenter Edition Avaya S8100 Media Servers 0 Avaya S3400 Message Application Server 0 Avaya Modular Messaging (MSS) 2.0 Avaya Modular Messaging (MSS) 1.1 Avaya IP600 Media Servers Avaya DefinityOne Media Servers |
| Not Vulnerable: |
RealNetworks RealPlayer 10.5 v6.0.12.1056 Microsoft Windows XP Professional SP2 Microsoft Windows XP Home SP2 |
Discussion
Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
Microsoft Windows contains a buffer overflow in the Compressed (zipped) Folders feature. A maliciously crafted compressed file could overrun an internal buffer causing arbitrary code to be executed in the security context of the current user.
Microsoft Windows contains a buffer overflow in the Compressed (zipped) Folders feature. A maliciously crafted compressed file could overrun an internal buffer causing arbitrary code to be executed in the security context of the current user.
Exploit / POC
Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
The following exploit has been provided:
The following exploit has been provided:
Solution / Fix
Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
Solution:
Microsoft has released a bulletin that includes fixes to address this issue for supported versions of the operating system.
RealNetworks has released a security advisory outlining a buffer overflow vulnerability in skin file processing due to this issue. The advisory also outlines affected packages and solutions. Please see the referenced advisory for more information and contact the vendor for upgrade availability.
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows Server 2003 Web Edition
Microsoft Windows XP Home
Microsoft Windows XP Home SP1
Microsoft Windows XP Media Center Edition
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows Server 2003 Datacenter Edition
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows Server 2003 Standard Edition
Microsoft Windows XP 64-bit Edition Version 2003
Microsoft Windows Server 2003 Enterprise Edition
Microsoft Windows XP Professional
Microsoft Windows XP Professional SP1
Microsoft Windows XP Tablet PC Edition
Microsoft Windows Server 2003 Datacenter Edition Itanium 0
Solution:
Microsoft has released a bulletin that includes fixes to address this issue for supported versions of the operating system.
RealNetworks has released a security advisory outlining a buffer overflow vulnerability in skin file processing due to this issue. The advisory also outlines affected packages and solutions. Please see the referenced advisory for more information and contact the vendor for upgrade availability.
Microsoft Windows XP Media Center Edition SP1
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows Server 2003 Web Edition
-
Microsoft Security Update for Windows Server 2003 (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=0903569E-7F3D -4846-A1DC-78734E77D3A9&displaylang=en
Microsoft Windows XP Home
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows XP Home SP1
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows XP Media Center Edition
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows Server 2003 Enterprise Edition Itanium 0
-
Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en -
Microsoft Security Update for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003 (K
http://www.microsoft.com/downloads/details.aspx?familyid=4B63EF24-D0E4 -4005-8E23-2F5EC24BE63F&displaylang=en
Microsoft Windows XP 64-bit Edition Version 2003 SP1
-
Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en -
Microsoft Security Update for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003 (K
http://www.microsoft.com/downloads/details.aspx?familyid=4B63EF24-D0E4 -4005-8E23-2F5EC24BE63F&displaylang=en
Microsoft Windows Server 2003 Datacenter Edition
-
Microsoft Security Update for Windows Server 2003 (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=0903569E-7F3D -4846-A1DC-78734E77D3A9&displaylang=en
Microsoft Windows XP 64-bit Edition SP1
-
Microsoft Security Update for Windows XP 64-bit Edition (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=3F6896F3-F055 -438D-93CE-CD15F37264CB&displaylang=en
Microsoft Windows Server 2003 Standard Edition
-
Microsoft Security Update for Windows Server 2003 (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=0903569E-7F3D -4846-A1DC-78734E77D3A9&displaylang=en
Microsoft Windows XP 64-bit Edition Version 2003
-
Microsoft Security Update for Windows Server 2003 64 Bit Edition and Windows XP 64 Bit Edition Version 2003 (
http://www.microsoft.com/downloads/details.aspx?FamilyId=C207D372-E883 -44A6-A107-6CD2D29FC6F5&displaylang=en -
Microsoft Security Update for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003 (K
http://www.microsoft.com/downloads/details.aspx?familyid=4B63EF24-D0E4 -4005-8E23-2F5EC24BE63F&displaylang=en
Microsoft Windows Server 2003 Enterprise Edition
-
Microsoft Security Update for Windows Server 2003 (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=0903569E-7F3D -4846-A1DC-78734E77D3A9&displaylang=en
Microsoft Windows XP Professional
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows XP Professional SP1
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows XP Tablet PC Edition
-
Microsoft Security Update for Windows XP (KB873376)
http://www.microsoft.com/downloads/details.aspx?familyid=6B70BA00-56D1 -4314-8F53-F8355A6861D3&displaylang=en
Microsoft Windows Server 2003 Datacenter Edition Itanium 0
-
Microsoft Security Update for Windows Server 2003 64-Bit Edition and Windows XP 64-Bit Edition Version 2003 (K
http://www.microsoft.com/downloads/details.aspx?familyid=4B63EF24-D0E4 -4005-8E23-2F5EC24BE63F&displaylang=en
References
Microsoft Windows Compressed (zipped) Folder Buffer Overflow Vulnerability
References:
References:
- Microsoft Security Bulletin MS04-034 (Microsoft)
- Skin Overflow: RealNetworks Releases Update to Address Security Vulnerabilities. (Real Networks)
- Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow Vulnerability (eEye Digital Security)