PT-2006-2969 · Pkware+1 · Zip+2

Published 2006-04-21 · Updated 2017-07-20 · CVE-2006-1985

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BOMArchiveHelper version 10.4 (6.3) Build 312 Mac OS X versions prior to 10.4.6

Description The issue allows user-assisted attackers to execute arbitrary code via a crafted archive, such as ZIP, that contains long path names. This triggers an error in the BOMStackPop function.

Recommendations For BOMArchiveHelper version 10.4 (6.3) Build 312, consider avoiding the use of crafted archives until a fix is available. For Mac OS X versions prior to 10.4.6, update to a version later than 10.4.6 to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-1985

Affected Products

Bomarchivehelper

Macos X

Zip

References · 15

• 🔥 https://exploit-db.com/exploits/27715 · Exploit
• http://vupen.com/english/advisories/2006/1452 · Vendor Advisory
• http://secunia.com/advisories/20077 · Vendor Advisory
• http://secunia.com/advisories/19686 · Vendor Advisory
• http://security-protocols.com/sp-x25-advisory.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-1985 · Security Note
• http://us-cert.gov/cas/techalerts/TA06-132A.html · Patch
• http://vupen.com/english/advisories/2006/1779 · Vendor Advisory
• http://securityfocus.com/bid/17951 · Note
• http://securitytracker.com/id?1016082 · Note
• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Patch, Vendor Advisory
• http://osvdb.org/24819 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25945 · Note
• http://security-protocols.com/modules.php?name=News&file=article&sid=3233 · Note
• http://securityfocus.com/bid/17634 · Note