PKWare PKZip Hostile Destination Path Vulnerability
BID:5933
Info
PKWare PKZip Hostile Destination Path Vulnerability
| Bugtraq ID: | 5933 |
| Class: | Access Validation Error |
| CVE: |
CVE-2001-1270 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2001 12:00AM |
| Updated: | Jul 11 2009 06:06PM |
| Credit: | Reported by 3APA3A <[email protected]>. |
| Vulnerable: |
PKWare PKZip 4.0 PKWare PKZip 2.5.1 PKWare PKZip 2.5 |
| Not Vulnerable: |
PKWare PKZip 5.5 PKWare PKZip 5.0 |
Discussion
PKWare PKZip Hostile Destination Path Vulnerability
PKWare PKZip is prone to a vulnerability in the handling of pathnames for archived files.
By specifying a path for an archived item which points outside the expected directory scope, the creator of the archive can cause the file to be extracted to arbitrary locations on the filesystem - including paths containing system binaries and other sensitive or confidential information.
This can be used to create or overwrite binaries in any desired location. Properly exploited, this grants the archive creator an elevation of privileges.
This issue is reported to exist in the console version of the software (pkzipc) and occurs when the recursive (-rec) command line option is specified during decompression.
PKWare PKZip is prone to a vulnerability in the handling of pathnames for archived files.
By specifying a path for an archived item which points outside the expected directory scope, the creator of the archive can cause the file to be extracted to arbitrary locations on the filesystem - including paths containing system binaries and other sensitive or confidential information.
This can be used to create or overwrite binaries in any desired location. Properly exploited, this grants the archive creator an elevation of privileges.
This issue is reported to exist in the console version of the software (pkzipc) and occurs when the recursive (-rec) command line option is specified during decompression.
Exploit / POC
PKWare PKZip Hostile Destination Path Vulnerability
There is no exploit required.
There is no exploit required.
Solution / Fix
PKWare PKZip Hostile Destination Path Vulnerability
Solution:
Users should contact the vendor to determine if a fixed version is available for their operating system.
FreeBSD has released upgrades. Users are advised to upgrade their Ports
collection and reinstall the affected port.
Solution:
Users should contact the vendor to determine if a fixed version is available for their operating system.
FreeBSD has released upgrades. Users are advised to upgrade their Ports
collection and reinstall the affected port.
References
PKWare PKZip Hostile Destination Path Vulnerability
References:
References: