PT-2004-1062 · None · Lha Package+1

Publicado 2004-09-07 · Atualizado 2017-10-11 · CVE-2004-0745

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LHA versions 1.14 and earlier lha package version 1.00

Description The issue allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name, potentially leading to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For LHA versions 1.14 and earlier, consider updating to a newer version to mitigate the risk. For lha package version 1.00, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2015-06300

CVE-2004-0745

RHSA-2004:323

Produtos afetados

Lha

Lha Package

Referências · 9

• https://rhn.redhat.com/errata/RHSA-2004-440.html · Nota
• http://gentoo.org/security/en/glsa/glsa-200409-13.xml · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-06300 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17198 · Nota
• https://bugzilla.fedora.us/show_bug.cgi?id=1833 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11088 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-0745 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2004-323.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2004-440.html · Aviso do Fabricante