CVE-2005-4667 Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, t...
LowCVSS 3.7
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| info-zip unzip | = 5.2 | No fix listed |
| info-zip unzip | = 5.3 | No fix listed |
| info-zip unzip | = 5.31 | No fix listed |
| info-zip unzip | = 5.32 | No fix listed |
| info-zip unzip | = 5.40 | No fix listed |
| info-zip unzip | = 5.41 | No fix listed |
| info-zip unzip | = 5.42 | No fix listed |
| info-zip unzip | = 5.50 | No fix listed |
| debian/unzip(Debian:12) | < 5.52-7 | 5.52-7 |
| debian/unzip(Debian:13) | < 5.52-7 | 5.52-7 |
| debian/unzip(Debian:14) | < 5.52-7 | 5.52-7 |
References
- Debian Security Tracker CVE-2005-4667 vendor-advisory
- bugs.debian.org issue-tracking
- 20051219 Unzip *ALL* verisons ;)) exploit mailing-list
- 25098 third-party-advisory
- DSA-1012 patch vendor-advisory
- www.info-zip.org
- MDKSA-2006:050 vendor-advisory
- 22400 vdb-entry
- RHSA-2007:0203 vendor-advisory
- FLSA:180159 vendor-advisory
- 15968 exploit vdb-entry
- 2006-0006 patch vendor-advisory
- oval:org.mitre.oval:def:11252 signature vdb-entry
- USN-248-1 vendor-advisory
- USN-248-2 vendor-advisory