PT-2005-3885 · Igor Pavlov · 7-Zip

Tan Chew Keong · Published 2005-09-23 · Updated 2017-07-11 · CVE-2005-3051

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 7-Zip versions 3.13, 4.23, and 4.26 BETA

Description A stack-based buffer overflow issue exists in the ARJ plugin (arj.dll) version 3.9.2.0 for 7-Zip, which can be exploited by remote attackers to execute arbitrary code via a large ARJ block.

Recommendations For 7-Zip version 3.13, update to a version that includes a fix for the ARJ plugin issue. For 7-Zip version 4.23, update to a version that includes a fix for the ARJ plugin issue. For 7-Zip version 4.26 BETA, update to a version that includes a fix for the ARJ plugin issue. As a temporary workaround, consider disabling the ARJ plugin (arj.dll) until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2005-3051

Affected Products

7-Zip

References · 11

• http://vupen.com/english/advisories/2006/4603 · Vendor Advisory
• http://secunia.com/secunia_research/2005-45/advisory · Vendor Advisory
• http://secunia.com/advisories/16664 · Vendor Advisory
• http://secunia.com/advisories/23004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3051 · Security Note
• http://securitytracker.com/id?1017261 · Note
• http://securityfocus.com/bid/14925 · Note
• http://vuln.sg/turbosearcher330-en.html · Note
• http://securityfocus.com/bid/21208 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30438 · Note
• http://marc.info/?l=bugtraq&m=112749134603258&w=2 · Note