SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Apache Commons Components Vendors:   Apache Software Foundation
Apache Commons Components Infinite Loop in Parsing ZIP Archives Lets Remote Users Deny Service
SecurityTracker Alert ID:  1040549
SecurityTracker URL:  http://securitytracker.com/id/1040549
CVE Reference:   CVE-2018-1324   (Links to External Site)
Date:  Mar 19 2018
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Compress 1.11 to 1.15
Description:   A vulnerability was reported in Apache Commons Components. A remote user can cause denial of service conditions on the target system.

A remote user can send a specially crafted ZIP archive to trigger an infinite loop in the ZipFile and ZipArchiveInputStream classes.

Services that use the ZipFile and ZipArchiveInputStream classes are affected.

Luis Filipe Nassif reported this vulnerability.

Impact:   A remote user can cause denial of service conditions.
Solution:   The vendor has issued a fix (1.16).

The vendor advisory is available at:

https://commons.apache.org/proper/commons-compress/security-reports.html#Fixed_in_Apache_Commons_Compress_1.16

Vendor URL:  commons.apache.org/proper/commons-compress/security-reports.html#Fixed_in_Apache_Commons_Compress_1.16 (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  [oss-security] [CVE-2018-1324] Apache Commons Compress denial of service vulnerability

CVE-2018-1324: Apache Commons Compress denial of service vulnerability

Severity: Low

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Commons Compress 1.11 to 1.15

Description:
A specially crafted ZIP archive can be used to cause an infinite loop
inside of Compress' extra field parser used by the ZipFile and
ZipArchiveInputStream classes.  This can be used to mount a denial of
service attack against services that use Compress' zip package.

Mitigation:
Commons Compress users should upgrade to 1.16 or later

Credit:
This issue was discovered by Luis Filipe Nassif.
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC