CVE-2023-45853: Zlib MiniZip Buffer Overflow Vulnerability

CVE-2023-45853 Overview

MiniZip in zlib through version 1.3 has a critical integer overflow vulnerability leading to heap-based buffer overflow. This vulnerability is triggered in the function zipOpenNewFileInZip4_64 when handling excessively long filenames, comments, or extra fields. While MiniZip is not supported in the zlib product, it impacts applications like pyminizip that bundle the vulnerable code through its compress API.

Critical Impact

An integer overflow in MiniZip leads to a severe heap-based buffer overflow.

Affected Products

• zlib zlib
• smihica pyminizip

Discovery Timeline

• 2023-10-14 - CVE CVE-2023-45853 published to NVD
• 2024-12-20 - Last updated in NVD database

Technical Details for CVE-2023-45853

Vulnerability Analysis

This vulnerability involves an integer overflow within zipOpenNewFileInZip4_64, which can result in a heap-based buffer overflow. By exploiting this flaw, an attacker could cause the application to crash or potentially execute arbitrary code.

Root Cause

The root cause is due to improper handling of integer boundaries, allowing overflow when calculating buffer sizes based on input lengths without adequate bounds checking.

Attack Vector

The vulnerability can be exploited over a network where maliciously crafted ZIP files are supplied to an application using the affected zlib version or pyminizip.

// Example exploitation code (sanitized)
#include <stdio.h>
#include <string.h>

int main() {
    char filename[256];
    memset(filename, 'A', 300); // Exceeding buffer length intentionally
    // Call vulnerable code
    return 0;
}

Detection Methods for CVE-2023-45853

Indicators of Compromise

• Unknown crash reports involving zlib
• Unexpected termination of file extraction operations
• Alert from Intrusion Detection Systems (IDS) for abnormal file handling activity

Detection Strategies

Monitoring and logging all instances of zipOpenNewFileInZip4_64 function calls, especially with unusually long parameters. Analyze application logs for segmentation faults or memory errors related to file handling.

Monitoring Recommendations

Employ Host-based Intrusion Detection Systems (HIDS) and utilize memory monitoring tools to detect anomalous application behaviors, such as buffer overflows and segmentation faults during zip file operations.

How to Mitigate CVE-2023-45853

Immediate Actions Required

• Verify and apply latest patches as provided by zlib and pyminizip maintainers.
• Restrict input lengths and validate data inputs meticulously to ensure boundaries are observed.
• Deploy application firewalls that can inspect manipulation attempts on file structures.

Patch Information

Patches are available via several advisory links, such as from chromium.googlesource.com and the GitHub zlib repository. Ensure to update to the latest version as per vendor advisories.

Workarounds

If immediate patching is not possible, consider isolating applications using vulnerable libraries and monitor their outputs. Additionally, restrict file upload paths and validate inputs rigorously at the application layer.

# Configuration example
ulimit -c 0     # Disable core dumps
seccomp enable  # Use seccomp profiles to restrict syscalls