Re: Re: Pointer misuse unziping files with busybox

[Rich Felker <dalias () libc org>]

On Thu, Oct 29, 2015 at 02:04:51AM -0400, cve-assign () mitre org wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > http://git.busybox.net/busybox/commit/?id=1de25a6e87e0e627aa34298105a3d17c60a1f44e
>
> > Unziping a specially crafted zip file results in a computation of an invalid
> > pointer and a crash reading an invalid address.
>
> Could you please comment directly about the likelihood of
> exploitability for code execution? See the
> http://www.openwall.com/lists/oss-security/2015/10/11/5 post. We
> currently feel that a CVE assignment for a non-exploitable unzip crash
> on BusyBox may be unlikely, because BusyBox wouldn't realistically be
> used for deployment of a program that remains running to offer an
> unzipping service to multiple clients.

There are several distributions including Alpine Linux, widely used in
container environments, which by default use busybox to provide the
unzip utility. Unzipping of any files downloaded by the user, possibly
from untrusted sources, may be affected. I believe CVE is appropriate
for user-facing programs commonly used to open untrusted files even
without an automated process accepting and processing
potentially-malicious files from a client.

Rich