PT-2005-3558 · Hauri · Virobot Expert+3

Publicado 2005-08-23 · Atualizado 2008-09-05 · CVE-2005-2670

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions HAURI Anti-Virus products including ViRobot Expert version 4.0 HAURI Anti-Virus products including Advanced Server (affected versions not specified) HAURI Anti-Virus products including Linux Server version 2.0 HAURI Anti-Virus products including LiveCall (affected versions not specified)

Description The issue allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in various archive file types, including ACE, ARJ, CAB, LZH, RAR, TAR, and ZIP files.

Recommendations For ViRobot Expert version 4.0, update to a version that includes a fix for the directory traversal issue. For Advanced Server, apply the necessary configuration changes or patches as recommended by the vendor to address the issue. For Linux Server version 2.0, restrict access to archive files until a patch is available. For LiveCall, avoid processing archive files with ".." sequences in filenames until the issue is resolved.

Correção

Identificadores relacionados

CVE-2005-2670

Produtos afetados

Advanced Server

Linux-Vserver

Livecall

Virobot Expert

Referências · 6

• http://globalhauri.com/html/download/down_unixpatch.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-2670 · Nota de Segurança
• http://securityfocus.com/bid/14606 · Nota
• http://secunia.com/advisories/15846 · Aviso do Fabricante
• http://secunia.com/secunia_research/2005-24/advisory · Aviso do Fabricante
• http://securitytracker.com/id?1014740 · Aviso do Fabricante