PT-2005-3865 · Ahnlab · Ahnlab V3Net For Windows Server+2

Publicado 2005-09-21 · Atualizado 2016-10-18 · CVE-2005-3030

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AhnLab V3Pro versions 2004 build 6.0.0.383 AhnLab V3 VirusBlock versions 2005 build 6.0.0.383 AhnLab V3Net for Windows Server versions 6.0 build 6.0.0.383

Description The issue allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in a compressed archive, due to a directory traversal vulnerability in the archive decompression library.

Recommendations For AhnLab V3Pro version 2004 build 6.0.0.383, consider restricting access to the archive decompression library until a patch is available. For AhnLab V3 VirusBlock version 2005 build 6.0.0.383, avoid using the archive decompression feature with untrusted compressed archives until the issue is resolved. For AhnLab V3Net for Windows Server version 6.0 build 6.0.0.383, as a temporary workaround, consider disabling the decompression of archives from untrusted sources.

Correção

Identificadores relacionados

CVE-2005-3030

Produtos afetados

Ahnlab V3 Virusblock

Ahnlab V3Net For Windows Server

Ahnlab V3Pro

Referências · 6

• http://secunia.com/secunia_research/2005-17/advisory · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3030 · Nota de Segurança
• http://info.ahnlab.com/english/advisory/01.html · Aviso do Fabricante
• http://secunia.com/advisories/15674 · Aviso do Fabricante
• http://securityfocus.com/bid/14848 · Correção
• http://marc.info/?l=bugtraq&m=112680062609377&w=2 · Nota