PT-2019-5050 · Info Zip+4 · Info-Zip Unzip+4

Published 2019-07-02 · Updated 2024-10-16 · CVE-2019-13232

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Info-ZIP UnZip version 6.0

Description The issue is related to the mishandling of overlapping files inside a ZIP container, which can lead to denial of service due to resource consumption, also known as a "better zip bomb" issue. Additionally, there is a vulnerability related to the use of memory after it has been freed, which can be exploited by a remote attacker to cause a denial of service.

Recommendations For Info-ZIP UnZip version 6.0, consider updating to a newer version that addresses the memory handling and zip bomb issues, although the specific updated version is not specified in the provided information. As a temporary workaround, restrict the use of Info-ZIP UnZip to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2024-13675

ALT-PU-2024-13679

ALT-PU-2024-13944

AZL-35341

AZL-6943

BDU:2020-01692

CESA-2020_1181

CESA-2020_1787

CVE-2019-13232

DLA-1846-1

DLA-1846-2

MGASA-2021-0033

RHSA-2020:1181

RHSA-2020:1787

RHSA-2020:2486

RHSA-2020_1181

RHSA-2020_1787

USN-4672-1

Affected Products

Alt Linux

Centos

Info-Zip Unzip

Red Hat

Ubuntu

References · 43

• 🔥 https://github.com/ByteHackr/unzip_poc · Exploit
• 🔥 https://github.com/nanaao/unzip_poc · Exploit
• https://ubuntu.com/security/CVE-2016-9844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13232 · Security Note
• https://ubuntu.com/security/CVE-2018-1000035 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0033 · Vendor Advisory
• https://security.gentoo.org/glsa/202003-58 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4672-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0033.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-13232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13232 · Security Note
• https://ubuntu.com/security/CVE-2018-18384 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1846-2 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1181.html · Vendor Advisory