Slashdot Mirror
StuffIt 6.5.x and Earlier Allows Buffer Overflow
A user writes in that Aladdin Systems has announced that StuffIt, versions 6.5.x and earlier for Mac OS and Mac OS X, "may contain a flaw that would cause expanding certain maliciously crafted .zip archives to execute unwanted instructions or code." Aladdin notes that no such "trojan horses" have been reported. StuffIt Expander 7.0 is, as with previous versions, free to download and use.
My first experience with stuffit expander 7 was a very slow one compared to the previous version (that came with Jagwyre). So I downgrades first chance.
You shouldn't be using zip files on mac in general unless it is some sort of code or something. Malicious code would require a specific target platform of the mac to do anything substantial, and being that nobody in their right mind would create zip files for mac, i don't see much problem.
What we see depends on mainly what we look for. -- John Lubbock Now search for that bug slave!
If you're using MacOS 9 or earlier, the potential for buffer overflows is meaningless. It wouldn't be the first time your system bailed, anyway.
For the OS X user, just adjust your browser to make Info-zip the zip file helper, and surf over to Info-zip's site to download the source or binary.
Luke, help me take this mask off
Or perhaps Aladdin just wants us to upgrade to Stuffit Expander 7, so they made up a security flaw to push their new "sitx" format...
Well, what about those of us who bought Stuffit Deluxe 6.5? What if I bought FIFTY COPIES OF IT (for a lab), and I don't feel like paying for an upgrade to 7.0 yet? Looks like I'm screwed. This is not acceptible behaviour! Even Microsoft doesn't (always) act like this when security holes crop up in the previous version of their product. If Aladdin doesn't offer a patch for 6.5, I will be quite annoyed.
Imagine what would happen if MS stopped fixing security holes in Windows 2000 all of a sudden when Windows XP came out? They would be shot in the street!
Sorry for the sweeping generalization, but this *really* does not please me.
Unchecked Buffer in File Decompression Functions Could Lead to Code Execution (Q329048):
Two vulnerabilities exist in the Compressed Folders function:
The Terrible Secret of Space, by The Laziest Men on Mars, of course. Even better is the Flash music video.
I've always had sort of a dim view of StuffIt.
On the one hand, Stuffit has a really incredibly amazingly good interface. You can navigate through a Stuffit archive like the Finder -- it's hierarchical, supports file operations, etc. WinZip, on the other hand, has a truly amazingly awful interface. Whoever decided that it would be a really cool idea to represent files in a flat interface and then throw a big fat toolbar in (I *hate* toolbars...awful UI element) above them should be whacked.
Anyway, the down side of Stuffit is that it is THE Mac file compression format. Compact Pro has unfortunately fallen by the wayside, and even that contender was, amazingly enough, propriatary. Why the hell can't anyone slap together tar + gzip + macbinary for the MacOS with a GUI (or something a smidgen more complicated, fair enough), so that Mac users aren't beholden to the whims of a single company? If Aladdin wanted to, they could charge $200 for their product. Not for long, but it's disgusting that they have no competition.
Stuffit's had a long history of being exploitable. Hand it corrupted resources and try to open the file...it crashes. Create an archive containing tens of thousands of locked invisible files at the root of the archive (actually, I think Stuffit clears the lock bit, though invis is still valid), and watch what happens when a poor user drops the archive on Stuffit Expander.
May we never see th
Going through Aladdin's web site requires you to fill out a short (marketing) form before downloading Expander. Fortunately, Aladdin also has anonymous ftp access
ftp://ftp.aladdinsys.com/
I feel your pain.
Can't you see that everyone is buying station wagons?
Why bother, when it's already installed as part of Mac OS X? There's no manpage, but the executable is /usr/bin/zip (and /usr/bin/unzip). The 10.2.1 version says:
Ceterum censeo subscriptionem esse delendam.
Now you've done it. He's going to stalk you all over slashdot like he stalks me.
T Money
World Domination with a plastic spoon since 1984
First off, the term is buffer overflow, a buffer underrun happens during burning a CD. They work by writing data past the end of an array (usually a string buffer) literally overflowing the buffer. By writing the right data into the right places, you can replace code that was going to be executed with your own code.