PT-2006-2285 · Zoo · Zoo

Josh Bressers · Publicado 2006-03-19 · Atualizado 2017-07-20 · CVE-2006-1269

Positive Technologies (AI Summary)

CVSS v2.0

6.2

Média

Vetor base

AV:L/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions zoo version 2.10

Description A buffer overflow issue exists in the parse function, potentially allowing local users to execute arbitrary code via long filename command line arguments during archive creation. The impact is limited due to the local nature of the issue and the lack of setuid, but there may be scenarios where the zoo user automatically lists attacker-controlled filenames, increasing the risk.

Recommendations For zoo version 2.10, consider restricting the length of filename command line arguments to prevent buffer overflow exploitation until a patch is available. As a temporary workaround, avoid using long filenames when creating archives with zoo.

Exploit

Correção

Identificadores relacionados

CVE-2006-1269

Produtos afetados

Zoo

Referências · 9

• 🔥 http://secunia.com/advisories/19250 · Exploit
• 🔥 https://exploit-db.com/exploits/27425 · Exploit
• 🔥 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426 · Exploit
• 🔥 http://gentoo.org/security/en/glsa/glsa-200603-12.xml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1269 · Nota de Segurança
• http://vupen.com/english/advisories/2006/0969 · Nota
• http://secunia.com/advisories/19254 · Nota
• http://securityfocus.com/bid/17126 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25264 · Nota