bugtraq - unzip directory traversal revisited

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 10 May 2003 00:39:24 +0200
From: "jelmer" <jelmer@...erus.xs4all.nl>
To: <bugtraq@...urityfocus.com>
Subject: unzip directory traversal revisited

unzip directory traversal revisited

problem:

well I kinda stumbled over this when i was looking for something else
A while back some fuss was made over the use of .. sequences in archives
because it allows you to craft
an archive which will trojan your system on extraction
the creators of unzip fixed this but apperently didn't cover all bases

when an archive contains a file like ../JELMER.TXT it will skip it and print
out a message like this

jelmer.zip
warning:  skipped "../" path component(s) in jelmer.zip
  inflating: JELMER.TXT

however when i call it . \003 ./JELMER.txt it extracts it just fine or  \001
etc

unzip jelmer.zip
Archive:  jelmer.zip
 extracting: ../JELMER.TXT

as it basicly ignores these characters

example:

i attached a zip file that illustrates the problem
it was hacked up using a hex editor

vendor status:

i just emailed Zip-Bugs@...ts.wku.edu

tested on :

UnZip 5.50 on a gentoo linux and freebsd

Download attachment "jelmer.zip" of type "application/octet-stream" (151 bytes)