PT-2021-11021 · Izarc+3 · Izarc+3

Hans Jerry Illikainenadvisoriesblogexploits · Published 2021-02-22 · Updated 2021-02-27 · CVE-2020-24175

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Yz1 versions 0.30 through 0.32 IZArc version 4.4 ZipGenius version 6.3.2.3116 Explzh (extension) version 8.14

Description: A buffer overflow issue allows attackers to execute arbitrary code via a crafted archive file, related to filename handling. This issue affects various software products that utilize the vulnerable Yz1 component.

Recommendations: For Yz1 versions 0.30 through 0.32, update to a version that fixes the buffer overflow issue. For IZArc version 4.4, consider disabling the use of Yz1 until a patch is available. For ZipGenius version 6.3.2.3116, restrict the handling of archive files to minimize the risk of exploitation. For Explzh (extension) version 8.14, avoid using the extension with potentially crafted archive files until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2020-24175

Affected Products

Explzh

Izarc

Yz1

Zipgenius

References · 7

• 🔥 https://illikainen.dev/advisories/014-yz1-izarc · Exploit
• 🔥 https://gist.github.com/illikainen/315a420a9c28cbe882e16b8eba40b2e1 · Exploit
• 🔥 https://gist.github.com/illikainen/ced14e08e00747fef613ba619bb25bb4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-24175 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24175 · Vendor Advisory
• http://yz1.com · Note
• https://t.me/cibsecurity/23934 · Telegram Post