Description
unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of service (infinite loop) via a ZOO archive with a direntry structure that points to a previous file.
References
- http://www.amavis.org/security/asa-2007-2.txt
- multiple-vendor-zoo-dos(34080) vdb-entry
- 36208 vdb-entry
- 23823 vdb-entry
- 25315 third-party-advisory
- 20070504 Multiple vendors ZOO file decompression infinite loop DoS mailing-list
- 2680 third-party-advisory