plan

Challenge Information

Project: apache-commons-compress

Type: delta

Harnesses: 16

Vulnerabilities: 1

GitHub • Challenge Download • Challenge Diff

AFC Challenge Performance

Number of Unique Vulnerabilities Discovered: #

Number of Teams with Scoring PoVs: 4

Number of Teams with Scoring Patches: 5

Number of Teams with Scoring Bundles: 2

Total Points Scored for this Challenge: 38.49019195162802

Commons Compress - plan

This challenge is a delta scan challenge. The challenge includes one synthetic vulnerability (vuln_10).

Challenge Rounds

This challenge has been included in the following set of rounds.

Exhibition Round 3

Challenge Harnesses

ArchiverArFuzzer
ArchiverArjFuzzer
ArchiverCpioFuzzer
ArchiverDumpFuzzer
ArchiverTarStreamFuzzer
ArchiverZipStreamFuzzer
CompressorBZip2Fuzzer
CompressorDeflate64Fuzzer
CompressorGzipFuzzer
CompressorLZ4Fuzzer
CompressorSnappyFuzzer
CompressorZFuzzer
CompressSevenZFuzzer
CompressTarFuzzer
CompressZipFuzzer
ExpanderFuzzer

Challenge Vulnerabilities

gzip command injection backdoor, more advanced

Vulnerability Information

Author: Tim Allison

Harness: CompressorGzipFuzzer

CWE Classification: CWE-77 , CWE-28

Description

This is a more advanced version of the simpler gzip backdoor.

For this to be triggered:

a) the file must be a “concatenated gzip” b) this set of equations must be solved and the correct metadata written to the second gzip stream:

if (Math.pow(compressionLevel, operatingSystem) == parameters.getModificationTime() &&
        Math.pow(operatingSystem, compressionLevel) == 841L) ...