User: Password:
Subscribe / Log in / New account

infozip: privilege escalation, directory-traversal

Package(s):infozip CVE #(s):CAN-2003-0282 CAN-2004-1010 CAN-2005-0602
Created:May 2, 2005 Updated:August 1, 2005
Description: InfoZip reports that Zip 2.3 and (presumably) all previous versions have a buffer-overrun vulnerability relating to deep directory paths that could potentially lead to local privilege escalation (e.g., in the case of automated, Zip-based backups). All versions of UnZip through 5.50 have a number of directory-traversal vulnerabilities.
Ubuntu USN-159-1 unzip 2005-08-01
Slackware SSA:2005-121-01 infozip 2005-05-02

(Log in to post comments)

infozip: privilege escalation, directory-traversal

Posted May 10, 2005 16:01 UTC (Tue) by roelofs (guest, #2599) [Link]

This was actually reported long ago, though the fix didn't come out until two months ago. And the UnZip vulnerabilities are even older news, having been fixed in Slackware almost two years ago and covered here at the same time.

Relevant CVE #s are CAN-2003-0282, CAN-2004-1010, and CAN-2005-0602. Some issues, like the symlink-traversal one, were never assigned a CVE number.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds