PT-2023-26799 · Archive · Archive

Bluesquare1 · Publicado 2023-08-30 · Atualizado 2024-10-01 · CVE-2023-39137

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Archive version 3.3.7

Description The issue allows attackers to spoof zip filenames, leading to inconsistent filename parsing.

Recommendations For Archive version 3.3.7, consider restricting the parsing of zip filenames to minimize the risk of exploitation until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-39137

GHSA-R285-Q736-9V95

Produtos afetados

Archive

Referências · 11

• 🔥 https://blog.ostorlab.co/zip-packages-exploitation.html · Exploit
• 🔥 https://ostorlab.co/vulndb/advisory/OVE-2023-3 · Exploit
• https://github.com/brendan-duncan/archive/issues/266 · Nota
• https://github.com/brendan-duncan/archive · Nota
• https://github.com/brendan-duncan/archive/commit/0d17b270a3c33d3bed56cadd9a43da7717ab11f4 · Nota
• https://rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing · Nota
• https://t.me/cibsecurity/69488 · Publicação no Telegram
• https://t.me/cvenotify/96760 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39137 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r285-q736-9v95 · Aviso do Fabricante