Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Linux :: Gentoo :: unzip.txt

Unzip 5.50 (Gentoo Linux) directory traversal

unzip directory traversal revisited


well I kinda stumbled over this when i was looking for something else
A while back some fuss was made over the use of .. sequences in archives
because it allows you to craft
an archive which will trojan your system on extraction
the creators of unzip fixed this but apperently didn't cover all bases

when an archive contains a file like ../JELMER.TXT it will skip it and print
out a message like this
warning: skipped "../" path component(s) in
inflating: JELMER.TXT

however when i call it . \003 ./JELMER.txt it extracts it just fine or \001

extracting: ../JELMER.TXT

as it basicly ignores these characters


i attached a zip file that illustrates the problem
it was hacked up using a hex editor

vendor status:

i just emailed <>

tested on :

UnZip 5.50 on a gentoo linux and freebsd

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH