PT-1996-1062 · Freebsd · Freebsd+1

Published 1996-07-16 · Updated 2008-09-05 · CVE-1999-1301

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FreeBSD versions prior to 2.1.5 rzsz module in FreeBSD versions prior to 2.1.5

Description A design flaw in the Z-Modem protocol allows a remote sender of a file to execute arbitrary programs on the client. This issue is related to the implementation in rz in the rzsz module.

Recommendations For FreeBSD versions prior to 2.1.5, update to version 2.1.5 or later to resolve the issue. For the rzsz module in FreeBSD versions prior to 2.1.5, update the module to a version included in FreeBSD 2.1.5 or later.

Fix

Related Identifiers

CVE-1999-1301

Affected Products

Freebsd

Rzsz

References · 4

• http://ciac.llnl.gov/ciac/bulletins/g-31.shtml · Vendor Advisory
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-96:17.rzsz.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-1999-1301 · Security Note
• http://iss.net/security_center/static/7540.php · Note