CVE-2003-0282 Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
LowCVSS 2.6
EPSS 22.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| info-zip unzip | = 5.50 | No fix listed |
| sco openlinux server | = 3.1.1 | No fix listed |
| sco openlinux workstation | = 3.1.1 | No fix listed |
| debian/unzip(Debian:12) | < 5.50-3 | 5.50-3 |
| debian/unzip(Debian:13) | < 5.50-3 | 5.50-3 |
| debian/unzip(Debian:14) | < 5.50-3 | 5.50-3 |
References
- Debian Security Tracker CVE-2003-0282 vendor-advisory
- CLA-2003:672 vendor-advisory
- IMNX-2003-7+-017-01 vendor-advisory
- 20030509 unzip directory traversal revisited mailing-list
- 20030710 [OpenPKG-SA-2003.033] OpenPKG Security Advisory (infozip) mailing-list
- N-111 government-resource third-party-advisory
- DSA-344 vendor-advisory
- www.info-zip.org
- MDKSA-2003:073 vendor-advisory
- RHSA-2003:199 patch vendor-advisory
- RHSA-2003:200 vendor-advisory
- 7550 exploit patch vdb-entry vendor-advisory
- TLSA-2003-42 vendor-advisory
- unzip-dotdot-directory-traversal(12004) vdb-entry
- oval:org.mitre.oval:def:619 signature vdb-entry