PT-2004-1062 · None · Lha Package+1

Published 2004-09-07 · Updated 2017-10-11 · CVE-2004-0745

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LHA versions 1.14 and earlier lha package version 1.00

Description The issue allows attackers to execute arbitrary commands via a directory with shell metacharacters in its name, potentially leading to disruption of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.

Recommendations For LHA versions 1.14 and earlier, consider updating to a newer version to mitigate the risk. For lha package version 1.00, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-06300

CVE-2004-0745

RHSA-2004:323

Affected Products

Lha

Lha Package

References · 9

• http://gentoo.org/security/en/glsa/glsa-200409-13.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06300 · Security Note
• https://bugzilla.fedora.us/show_bug.cgi?id=1833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0745 · Security Note
• http://redhat.com/support/errata/RHSA-2004-323.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-440.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2004-440.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17198 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11088 · Note