Cloudanix VulnDB

CVE-2014-9636

None

CVSS

—

EPSS

11.9%

Published

Feb 6, 2015

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in code that reads certain zip files can let someone send a bad file that makes the program crash, stopping whatever service relies on that program until it is restarted.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read or write during processing of ZIP extra fields where the uncompressed size is smaller than the compressed size for STORED-method entries, resulting in memory corruption and process crash.

Why it matters to the business

Attackers can remotely crash affected virtualization and emulation software, causing denial of service that disrupts virtual machine operations and requires manual restarts or failovers.

How an attack unfolds

An attacker creates a specially crafted ZIP archive containing an extra field with mismatched size values for a STORED entry, then supplies the archive to any process using the vulnerable unzip code path; when the archive is parsed, the size inconsistency triggers an out-of-bounds access that crashes the process.

How to fix it

Upgrade affected packages to the listed fixed versions: qemu on Debian 11/12/13 to 1:2.6+dfsg-1, xen on Debian 11/12/13 to 4.4.0-1, and qemu on Ubuntu 14.04 LTS to 2.0.0+dfsg-2ubuntu1.24. Rebuild or redeploy any custom builds that statically link the vulnerable unzip code.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases, then test with a minimal ZIP crafted to contain an extra-field size mismatch under STORED compression and confirm the process no longer crashes.

Typical attack path

  1. Craft malicious ZIP with inconsistent extra-field sizes for STORED compression
  2. Deliver the archive to a target process that invokes unzip parsing (image import, archive extraction, etc.)
  3. Trigger parsing of the extra field
  4. Induce out-of-bounds memory access leading to crash

How to detect it

Review system and application crash logs for segmentation faults occurring during ZIP extraction or archive handling; correlate with file-system events showing recent receipt of ZIP archives from untrusted sources.

What your security team should do

  • Apply the listed fixed package versions immediately on all Debian and Ubuntu systems running qemu or xen
  • Scan archives entering the environment for anomalous extra-field size values as a temporary control
  • Monitor crash logs for unzip-related segmentation faults until patches are deployed

The record

unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.

Affected packages

Ecosystem Package Introduced Fixed
Alpine:v3.10 unzip 0 6.0-r3
Alpine:v3.11 unzip 0 6.0-r3
Alpine:v3.12 unzip 0 6.0-r3
Alpine:v3.13 unzip 0 6.0-r3
Alpine:v3.14 unzip 0 6.0-r3
Alpine:v3.15 unzip 0 6.0-r3
Alpine:v3.16 unzip 0 6.0-r3
Alpine:v3.17 unzip 0 6.0-r3
Alpine:v3.18 unzip 0 6.0-r3
Alpine:v3.19 unzip 0 6.0-r3
Alpine:v3.20 unzip 0 6.0-r3
Alpine:v3.21 unzip 0 6.0-r3
Alpine:v3.22 unzip 0 6.0-r3
Alpine:v3.5 unzip 0 6.0-r3
Alpine:v3.6 unzip 0 6.0-r3
Alpine:v3.7 unzip 0 6.0-r3
Alpine:v3.8 unzip 0 6.0-r3
Alpine:v3.9 unzip 0 6.0-r3
Debian:11 unzip 0 6.0-15
Debian:12 unzip 0 6.0-15
Debian:13 unzip 0 6.0-15
Debian:6.0 unzip 0 6.0-4+deb6u2
Debian:7 unzip 0 6.0-8+deb7u2
Red Hat:enterprise_linux:6::client unzip 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::client unzip-debuginfo 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::computenode unzip 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::computenode unzip-debuginfo 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::server unzip 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::server unzip-debuginfo 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::workstation unzip 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:6::workstation unzip-debuginfo 0 0:6.0-2.el6_6
Red Hat:enterprise_linux:7::client unzip 0 0:6.0-15.el7
Red Hat:enterprise_linux:7::client unzip-debuginfo 0 0:6.0-15.el7
Red Hat:enterprise_linux:7::computenode unzip 0 0:6.0-15.el7
Red Hat:enterprise_linux:7::computenode unzip-debuginfo 0 0:6.0-15.el7
Red Hat:enterprise_linux:7::server unzip 0 0:6.0-15.ael7b
Red Hat:enterprise_linux:7::server unzip-debuginfo 0 0:6.0-15.ael7b
Red Hat:enterprise_linux:7::workstation unzip 0 0:6.0-15.el7
Red Hat:enterprise_linux:7::workstation unzip-debuginfo 0 0:6.0-15.el7
SUSE:Linux Enterprise Desktop 12 unzip 0 6.00-32.1
SUSE:Linux Enterprise Desktop 12 SP3 unzip 0 6.00-33.8.1
SUSE:Linux Enterprise Module for Basesystem 15 unzip 0 6.00-4.3.1
SUSE:Linux Enterprise Server 12 unzip 0 6.00-32.1
SUSE:Linux Enterprise Server 12 SP3 unzip 0 6.00-33.8.1
SUSE:Linux Enterprise Server for SAP Applications 12 unzip 0 6.00-32.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP3 unzip 0 6.00-33.8.1
Ubuntu:14.04:LTS unzip 0 6.0-9ubuntu1.2
openSUSE:Tumbleweed unzip 0 6.00-39.1

Related vulnerabilities