PT-2002-2138 · Microsoft · Windows+1

Published 2002-10-11 · Updated 2018-10-12 · CVE-2002-1139

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to the fixed version

Description: The issue arises from the Compressed Folders feature in Microsoft Windows not properly checking the destination folder during the decompression of ZIP files. This allows attackers to place an executable file in a known location on a user's system.

Recommendations: For Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP, update to a version that includes the fix for the Compressed Folders feature to properly check the destination folder during ZIP file decompression. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2002-1139

Affected Products

Compressed Folders

Windows

References · 4

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1139 · Security Note
• http://iss.net/security_center/static/10252.php · Vendor Advisory
• http://securityfocus.com/bid/5876 · Note