PT-2001-1075 · Info Zip+1 · Unzip+1

Published 2001-07-12 · Updated 2010-05-25 · CVE-2001-1268

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions tar versions prior to 1.13.25 UnZip versions 5.42 and earlier

Description The issue concerns multiple vulnerabilities in the tar package and a directory traversal vulnerability in Info-ZIP UnZip. These vulnerabilities can be exploited remotely, potentially leading to the integrity of protected information being compromised. The directory traversal vulnerability in UnZip allows attackers to overwrite arbitrary files during archive extraction by using a .. (dot dot) in an extracted filename.

Recommendations For tar versions prior to 1.13.25, update to a version that contains a fix for this issue. For UnZip versions 5.42 and earlier, consider disabling the archive extraction feature until a patch is available, or restrict access to the archive extraction functionality to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-08351

CVE-2001-1268

Affected Products

Unzip

Tar

References · 7

• 🔥 http://online.securityfocus.com/archive/1/196445 · Exploit
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2001-1268 · Security Note
• https://bdu.fstec.ru/vul/2015-08351 · Security Note
• https://rhn.redhat.com/errata/RHSA-2002-096.html · Note
• http://info-zip.org/pub/infozip/UnZip.html · Note