Description
Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libarchive-zip-perl | 1.14-1 | — |
| Debian 13 | libarchive-zip-perl | 1.14-1 | — |
| Debian 12 | libarchive-zip-perl | 1.14-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Multiple AntiVirus - '.zip' Detection Bypass EDB-629 · local · Nov 14, 2004 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 13038 third-party-advisory
- MDKSA-2004:118 vendor-advisory
- antivirus-zip-protection-bypass(17761) vdb-entry
- VU#492545 third-party-advisory
- 11448 vdb-entry
- 20041018 Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability third-party-advisory
- GLSA-200410-31 vendor-advisory