Bugzilla – Bug 62234
VUL-0: CVE-2005-2349: directory traversal bug in zoo
Last modified: 2019-10-31 14:34:18 UTC
"doubles" again posted something about a directory traversal bug, this time in "unzoo". I checked our zoo program which is not unzoo but it is vulnerable as well. The issue is therefore semi-public. Just like with unarj it looks like one can only create new files but not overwrite existing ones.
Created attachment 24998 [details] archive that creates /etc/foo when extraced with zoo x
the intention is to create directories only under the current working direcory, right?
Yes. I think it is sufficient to fix it in STABLE. amavisd seems to extract each file to stdout individually and is therefore not affected.
will fix for 9.3
did you fix it?
fixes submitted
Where does the patch come from, did you write it yourself? If so did you coordinate with upstream? Is the string you sanitize a directory or a file name? If it's a dir name it would probably still allow one level dir traversals if the path ends in ".." instead of "../".
The patch is taken from Debian. It sanitizes a dirname. Could you please create an exploit with the few "../" and ".." on the end? The archive with the /etc/foo can be modified to contain the ".." on the end siply by swapping the "etc" and "..", but while not perfectly handled this is not an exploint, it can't leave the current directory. Striping the "etc" completely probably requires changing the CRC and I don't know how to do that.
I have no idea how to create crafted zoo archives. Too uncritical to waste much time. We'll just accept the patch then.
ok, fix submited with the check for ".."
Secteam, how about writing some patchinfos?
this was supposed to go into STABLE only.
sorry for the confusion, fixed
removed submissions for !STABLE