Description
Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- GetRight 5.2a - '.grs' Skin File Buffer Overflow EDB-677 · dos · Dec 6, 2004 · verified
- Microsoft Windows - Compressed Zipped Folders (MS04-034) EDB-640 · remote · Nov 19, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 1011637 vdb-entry
- oval:org.mitre.oval:def:3913 vdb-entry signature
- 20041013 EEYE: Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow Vulnerability mailing-list
- MS04-034 vendor-advisory
- P-010 third-party-advisory government-resource
- http://www.eeye.com/html/research/advisories/AD20041012A.html
- oval:org.mitre.oval:def:4276 vdb-entry signature
- oval:org.mitre.oval:def:1053 vdb-entry signature
- VU#649374 third-party-advisory
- win-compressed-folders-bo(17624) vdb-entry
- win-ms04034-patch(17659) vdb-entry
- oval:org.mitre.oval:def:6397 vdb-entry signature