unzoo EntrReadArch() Buffer Overflow Lets Remote Users Execute Arbitrary Code and Infinite Loop Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1032011 |
|
SecurityTracker URL: http://securitytracker.com/id/1032011
|
|
CVE Reference:
CVE-2015-1845, CVE-2015-1846
(Links to External Site)
|
Date: Apr 1 2015
|
Impact:
Denial of service via network, Execution of arbitrary code via network, User access via network
|
|
|
Description:
Several vulnerabilities were reported in unzoo. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions on the target system.
A remote user can create a specially crafted archive that, when uncompressed by the target user or application, will trigger a buffer overflow in EntrReadArch() and execute arbitrary code on the target system [CVE-2015-1845]. The code will run with the privileges of the target user or application.
A remote user can create a specially crafted archive that, when uncompressed by the target user or application, will cause the target application to enter an infinite loop [CVE-2015-1846].
William Robinet of Conostix S.A. reported these vulnerabilities.
|
Impact:
A remote user can execute arbitrary code on the target system.
A remote user can cause denial of service conditions.
|
Solution:
No solution was available at the time of this entry.
|
Cause:
Boundary error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
