PT-2002-1084 · Gnu+1 · Tar+1

Jelmer · Published 2002-05-20 · Updated 2017-10-11 · CVE-2003-0282

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions UnZip version 5.50 tar-1.13.25

Description The issue concerns a directory traversal vulnerability in UnZip, allowing attackers to overwrite arbitrary files by exploiting invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence. Additionally, there are multiple vulnerabilities in the tar package of Red Hat Linux that can lead to a breach of protected information integrity, and these can be exploited remotely.

Recommendations For UnZip version 5.50, consider restricting access to the vulnerable UnZip module to minimize the risk of exploitation until a patch is available. For tar-1.13.25, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-08351

CVE-2003-0282

DSA-344

Affected Products

Unzip

Tar

References · 22

• 🔥 http://securityfocus.com/bid/7550 · Exploit
• 🔥 https://exploit-db.com/exploits/22584 · Exploit
• http://redhat.com/support/errata/RHSA-2003-200.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08351 · Security Note
• http://turbolinux.com/security/TLSA-2003-42.txt · Vendor Advisory
• ftp://ftp.sco.com/pub/security/OpenLinux/CSSA-2003-031.0.txt · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0282 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0282 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0282 · Security Note
• http://redhat.com/support/errata/RHSA-2003-199.html · Vendor Advisory
• http://debian.org/security/2003/dsa-344 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000672 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:073 · Vendor Advisory
• http://download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-017-01 · Vendor Advisory