PT-2006-2990 · Izsoftware · Izarc Archiver

Publicado 2006-04-25 · Atualizado 2017-07-20 · CVE-2006-2006

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IZArc Archiver version 3.5 beta 3

Description The issue allows remote attackers to write arbitrary files via a .. (dot dot backslash) in various archive types, including .rar, .tar, .zip, .jar, and .gz archives.

Recommendations For IZArc Archiver version 3.5 beta 3, consider restricting the handling of archive files to prevent exploitation until a fix is available. As a temporary workaround, avoid using the software to extract archives from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2006-2006

Produtos afetados

Izarc Archiver

Referências · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/26039 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-2006 · Nota de Segurança
• http://osvdb.org/24895 · Nota
• http://secunia.com/advisories/19791 · Aviso do Fabricante
• http://securityfocus.com/bid/17664 · Nota
• http://vupen.com/english/advisories/2006/1488 · Nota