PT-2004-1119 · Unarj · Unarj

Published 2004-11-16 · Updated 2023-10-30 · CVE-2004-1027

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions unarj (affected versions not specified)

Description The issue is related to a directory traversal vulnerability in the -x (extract) command line option. This vulnerability allows remote attackers to overwrite arbitrary files by using an arj archive with filenames that contain .. (dot dot) sequences. The vulnerability is associated with insufficient path restriction, enabling an attacker to exploit it and overwrite files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2017-00281

CVE-2004-1027

DSA-652-1

MGASA-2023-0107

Affected Products

Unarj

References · 14

• http://redhat.com/support/errata/RHSA-2005-007.html · Vendor Advisory
• http://securityfocus.com/bid/11436 · Vendor Advisory
• http://lwn.net/Articles/121827 · Vendor Advisory
• http://debian.org/security/2005/dsa-628 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0107 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0107.html · Security Note
• http://debian.org/security/2005/dsa-652 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200411-29.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00281 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-1027 · Security Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2004-October/027348.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17684 · Note
• http://xforce.iss.net/xforce/xfdb/17684 · Note
• https://bugs.mageia.org/show_bug.cgi?id=31546 · Note