PT-2007-3299 · Archivexpert · Archivexpert

Published 2007-04-11 · Updated 2017-07-29 · CVE-2007-1954

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArchiveXpert version 2.02 build 80

Description The issue allows remote attackers to create files in arbitrary directories via a .. (dot dot) in various archive file types, including .gz, .jar, .rar, .tar.gz, .zip, and .tar files.

Recommendations For ArchiveXpert version 2.02 build 80, consider restricting the ability to upload or process archive files until a patch is available. As a temporary workaround, limit access to sensitive directories to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-1954

Affected Products

Archivexpert

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2007-1954 · Security Note
• http://secunia.com/advisories/24827 · Vendor Advisory
• http://bugtraq.ir/articles/advisory/archivexpert_directory_traversal/8 · Note
• http://vupen.com/english/advisories/2007/1311 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33539 · Note
• http://securityfocus.com/bid/23372 · Note