Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 30 Oct 2015 15:34:22 -0400
From: Rich Felker <>
Subject: Re: Re: Pointer misuse unziping files with busybox

On Thu, Oct 29, 2015 at 02:04:51AM -0400, wrote:
> Hash: SHA256
> >
> > Unziping a specially crafted zip file results in a computation of an invalid
> > pointer and a crash reading an invalid address.
> Could you please comment directly about the likelihood of
> exploitability for code execution? See the
> post. We
> currently feel that a CVE assignment for a non-exploitable unzip crash
> on BusyBox may be unlikely, because BusyBox wouldn't realistically be
> used for deployment of a program that remains running to offer an
> unzipping service to multiple clients.

There are several distributions including Alpine Linux, widely used in
container environments, which by default use busybox to provide the
unzip utility. Unzipping of any files downloaded by the user, possibly
from untrusted sources, may be affected. I believe CVE is appropriate
for user-facing programs commonly used to open untrusted files even
without an automated process accepting and processing
potentially-malicious files from a client.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.