Microsoft Windows processing of zip files contains a buffer overflow

Overview

A buffer overflow exists in the way Microsoft Windows processes zip files that may allow remote code execution.

Description

Microsoft Windows XP and Windows Server 2003 feature the ability to natively handle zip files. Microsoft has released bulletin MS04-034 describing a remotely exploitable buffer overflow vulnerability in the way Windows handles zip files. According to MS04-034:

_A remote code execution vulnerability exists in Compressed (zipped) Folders because of an unchecked buffer in the way that it handles specially crafted compressed files. An attacker could exploit the vulnerability by constructing a malicious compressed file that could potentially allow remote code execution if a user visited a malicious Web site. An attacker who successfully exploited this vulnerability could take complete control of an affected system. However, user interaction is required to exploit this vulnerability. _

For further technical information about this vulnerability, please see Microsoft Security Bulletin MS04-034.

---

Impact

If a remote attacker can persuade a user to access a specially crafted zip file, the attacker may be able to execute arbitrary code on that user’s system, possibly with administrator privileges.

---

Solution

Apply Patch

Apply a patch as described in Microsoft Security Bulletin MS04-034. Please also note that Microsoft is actively deploying the patches for this vulnerability via Windows Update.

Do Not Accept Zip Files from Untrusted Sources

Exploitation occurs by accessing a specially crafted zip file (.zip extension). By only accessing zip files from trusted or known sources, the chances of exploitation are reduced.

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-034.

---

Vendor Information

649374

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Microsoft Corporation __ Affected

Updated: October 13, 2004

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

For more details regarding remediation of this issue please see Microsoft Security Bulletin MS04-034.

If you have feedback, comments, or additional information about this vulnerability, please send us [email](<mailto:[email protected]?Subject=VU%23649374 Feedback>).

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.microsoft.com/technet/security/bulletin/MS04-034.mspx&gt;
• <http://securitytracker.com/alerts/2004/Oct/1011637.html&gt;

Acknowledgements

Microsoft has published Microsoft Security Bulletin MS04-034 to address this vulnerability. Microsoft credits eEye Digital Security for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2004-0575
Severity Metric:	27.11 Date Public: