PT-2004-1119 · Unarj · Unarj

CVE-2004-1027 · Publicado 2004-11-16 · Atualizado 2023-10-30

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions unarj (affected versions not specified)

Description The issue is related to a directory traversal vulnerability in the -x (extract) command line option. This vulnerability allows remote attackers to overwrite arbitrary files by using an arj archive with filenames that contain .. (dot dot) sequences. The vulnerability is associated with insufficient path restriction, enabling an attacker to exploit it and overwrite files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2017-00281

CVE-2004-1027

DSA-652-1

MGASA-2023-0107

Produtos afetados

Unarj

Referências · 14

• http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.html · Nota
• http://redhat.com/support/errata/RHSA-2005-007.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17684 · Nota
• http://xforce.iss.net/xforce/xfdb/17684 · Nota
• http://securityfocus.com/bid/11436 · Aviso do Fabricante
• http://lwn.net/Articles/121827 · Aviso do Fabricante
• http://debian.org/security/2005/dsa-628 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2023-0107 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2023-0107.html · Nota de Segurança
• http://debian.org/security/2005/dsa-652 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200411-29.xml · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00281 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2004-1027 · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=31546 · Nota