PT-2007-3356 · Mimarsinan · Mimarsinan Comprexx

Published 2007-04-12 · Updated 2017-07-29 · CVE-2007-2012

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MimarSinan CompreXX version 4.1

Description The issue concerns multiple directory traversal vulnerabilities. These vulnerabilities allow remote attackers to create files in arbitrary directories by including a .. (dot dot) in a .rar, .jar, or .zip archive.

Recommendations For MimarSinan CompreXX version 4.1, consider restricting the handling of .rar, .jar, and .zip archives to prevent directory traversal attacks until a patch is available. Avoid using the archive handling functionality in sensitive environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-2012

Affected Products

Mimarsinan Comprexx

References · 6

• http://secunia.com/advisories/24840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2012 · Security Note
• http://securityfocus.com/bid/23362 · Note
• http://bugtraq.ir/articles/advisory/comprexx_directory_traversal/7 · Note
• http://vupen.com/english/advisories/2007/1312 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33551 · Note