CVE-2023-48106
📋 TL;DR
A buffer overflow vulnerability in zlib-ng's minizip-ng library allows attackers to execute arbitrary code by providing a specially crafted file to the mz_path_resolve function. This affects any software using minizip-ng v4.0.2 for file compression/decompression operations. Systems processing untrusted archive files are particularly vulnerable.
💻 Affected Systems
- minizip-ng
- zlib-ng
- any software embedding minizip-ng library
📦 What is this software?
Minizip Ng by Zlib Ng
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the application using minizip-ng, potentially leading to complete system compromise.
Likely Case
Application crash (denial of service) or limited code execution depending on exploit sophistication and system protections.
If Mitigated
Application crash with no code execution if modern exploit mitigations (ASLR, DEP) are effective.
🎯 Exploit Status
The vulnerability requires an attacker to provide a crafted file, which could be delivered via email, downloads, or other file transfer mechanisms. Exploit development is straightforward given the buffer overflow nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: minizip-ng v4.0.3 and later
Vendor Advisory: https://github.com/zlib-ng/minizip-ng/issues/740
Restart Required: Yes
Instructions:
1. Update minizip-ng to version 4.0.3 or later. 2. Rebuild any applications using the library. 3. Restart affected services or applications.
🔧 Temporary Workarounds
Input validation
allImplement strict validation of file paths before passing to minizip-ng functions
Sandboxing
allRun minizip-ng processes in isolated containers or with reduced privileges
🧯 If You Can't Patch
- Implement network segmentation to limit access to vulnerable systems
- Deploy application allowlisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check if minizip-ng version 4.0.2 is installed or if applications link to this version of the libraryCheck Version:
For Linux: dpkg -l | grep minizip-ng or rpm -qa | grep minizip-ngVerify Fix Applied:
Verify minizip-ng version is 4.0.3 or later and applications have been rebuilt with the updated library📡 Detection & Monitoring
Log Indicators:
- Application crashes with segmentation faults
- Unusual file processing errors in application logs
Network Indicators:
- Unexpected file transfers to systems using minizip-ng
SIEM Query:
source="application_logs" AND ("segmentation fault" OR "buffer overflow" OR "mz_path_resolve")