PT-2006-1969 · Allume · Stuffit Expander+3

Published 2006-02-28 · Updated 2018-10-18 · CVE-2006-0926

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Allume StuffIt Standard and Deluxe version 9.0 Allume ZipMagic Deluxe version 9.0 Allume StuffIt Expander version 9.0.0.21 Engine 9.0.0.21

Description The issue allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a zip or tar archive.

Recommendations For Allume StuffIt Standard and Deluxe version 9.0, update to a version that fixes the directory traversal vulnerabilities. For Allume ZipMagic Deluxe version 9.0, update to a version that fixes the directory traversal vulnerabilities. For Allume StuffIt Expander version 9.0.0.21 Engine 9.0.0.21, update to a version that fixes the directory traversal vulnerabilities.

Fix

Related Identifiers

CVE-2006-0926

Affected Products

Stuffit Deluxe

Stuffit Expander

Stuffit Standard

Zipmagic Deluxe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-0926 · Security Note
• http://secunia.com/advisories/19010 · Vendor Advisory
• http://securityfocus.com/bid/16806 · Note
• http://osvdb.org/23463 · Note
• http://hamid.ir/security/stuffit.txt · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24886 · Note
• http://vupen.com/english/advisories/2006/0732 · Note
• http://securityfocus.com/archive/1/425972/100/0/threaded · Note