OSVDB ID: 10695

Title: Microsoft Windows Compressed Folders DUNZIP32.DLL File Handling Overflow

Info

Disclosure

Oct 12, 2004

Discovery

Aug 02, 2004

Dates

Exploit

Nov 18, 2004

Solution

Oct 12, 2004

Description

A remote overflow exists in Windows. Windows fails to properly validate input to dunzip32.dll resulting in a buffer overflow. With a specially crafted zip file with an overly long name, an attacker can cause the execution of arbitrary code resulting in a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS
Exploit: Exploit Public, Exploit Commercial
Disclosure: OSVDB Verified, Vendor Verified

Solution

Currently, there are no known workarounds or upgrades to correct this issue. However, Microsoft Corporation has released a patch to address this vulnerability.

Products

Microsoft Corporation	Windows	XP Professional
		XP Professional SP1
		XP Home
		XP Home SP 1
		XP 64-bit Edition SP1
		XP 64-bit Edition
		Server 2003
		Server 2003 64-bit Edition
		XP Professional 64-bit Edition 2003

References

Security Tracker: 1011637
OVAL ID: 1053 3913 4276 6397
Secunia Advisory ID: 12805
ISS X-Force ID: 17624 17659
CVE ID: 2004-0575 (see also: NVD)
Milw0rm: 640
Exploit Database: 640
CERT VU: 649374
Microsoft Knowledge Base Article: 873376
Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-10/0399.html
http://archives.neohapsis.com/archives/fulldisclosure/2004-11/0743.html
http://marc.theaimsgroup.com/?l=ntbugtraq&m=109767342326300&w=2
Other Advisory URL: http://research.eeye.com/html/advisories/published/AD20041012A.html
http://www.ciac.org/ciac/bulletins/p-010.shtml
http://www.eeye.com/html/research/advisories/AD20041012A.html [ Link is 404 ]
Generic Exploit URL: http://www.saintcorporation.com/cgi-bin/exploit_info/windows_compressed_folders
Microsoft Security Bulletin: MS04-034

Credit

Yuji Ukai - alerteEye.com - eEye Digital Security

Direct URL: http://osvdb.org/10695