Critical Zlib Vulnerability Let Attackers Trigger Buffer Overflow by Invoking untgz
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A severe global buffer overflow vulnerability<\/a> has been discovered in the zlib untgz utility version 1.3.1.2. Allowing attackers to corrupt memory and potentially execute malicious code through specially crafted command-line input.\u200b<\/p>\n The security flaw resides in the TGZfname() function of the untgz utility, where an unbounded strcpy() call processes user-supplied archive names without any length validation.<\/p>\n The vulnerability occurs when the utility copies attacker-controlled input from the command line into a fixed-size static global buffer of only 1,024 bytes.\u200b<\/p>\n The root cause stems from poor input handling: the archive name is derived directly from the argv[] parameters and copied into a global static array without bounds checking.<\/p>\n This overflow occurs immediately upon function entry, before any archive parsing or validation. Making the vulnerability trivially exploitable through command-line arguments alone.\u200b<\/p>\nTechnical Details<\/strong><\/h2>\n