PT-2007-5718 · Maxim Lantsov · Unreal Commander

Published 2007-08-27 · Updated 2018-10-15 · CVE-2007-4547

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Unreal Commander version 0.92 build 565 Unreal Commander version 0.92 build 573

Description The issue allows user-assisted attackers to obtain sensitive information, such as memory contents, by reading extracted files. This can occur when extracting from an archive with malformed size information in a file header. The extracted files may contain portions of heap memory. This issue is only considered a vulnerability if Unreal Commander is run with privileges or if the extracted files are made accessible to other users.

Recommendations For Unreal Commander version 0.92 build 565, avoid running the software with privileges and restrict access to extracted files to prevent other users from accessing potentially sensitive information. For Unreal Commander version 0.92 build 573, avoid running the software with privileges and restrict access to extracted files to prevent other users from accessing potentially sensitive information.

Fix

Related Identifiers

CVE-2007-4547

Affected Products

Unreal Commander

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-4547 · Security Note
• http://securityfocus.com/archive/1/477432/100/0/threaded · Note
• http://osvdb.org/45832 · Note
• http://securityfocus.com/bid/25419 · Note
• http://securityreason.com/securityalert/3060 · Note