PT-2004-1120 · Unrarj Team · Unarj

Published 2004-11-24 · Updated 2023-03-24 · CVE-2004-0947

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions unarj versions prior to 2.63a-r2

Description The issue is caused by a buffer overflow in the unarj library, which handles data archiving. This can be exploited by a remote attacker to execute arbitrary code using an arj archive containing files with excessively long filenames.

Recommendations For versions prior to 2.63a-r2, update to version 2.63a-r2 or later to resolve the issue. As a temporary workaround, consider avoiding the use of arj archives with long filenames until the update is applied.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-00282

CVE-2004-0947

DSA-652-1

MGASA-2023-0107

Affected Products

Unarj

References · 12

• http://lwn.net/Articles/121827 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200411-29.xml · Vendor Advisory
• http://debian.org/security/2005/dsa-652 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00282 · Security Note
• https://advisories.mageia.org/MGASA-2023-0107.html · Security Note
• http://securityfocus.com/bid/11665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-0947 · Security Note
• https://osv.dev/vulnerability/MGASA-2023-0107 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-007.html · Vendor Advisory
• http://xforce.iss.net/xforce/xfdb/18044 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18044 · Note
• https://bugs.mageia.org/show_bug.cgi?id=31546 · Note