CVE-2004-0235 Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute p...
MediumCVSS 6.4
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| clearswift mailsweeper | = 4.0 | No fix listed |
| clearswift mailsweeper | = 4.1 | No fix listed |
| clearswift mailsweeper | = 4.2 | No fix listed |
| clearswift mailsweeper | = 4.3 | No fix listed |
| clearswift mailsweeper | = 4.3.3 | No fix listed |
| clearswift mailsweeper | = 4.3.4 | No fix listed |
| clearswift mailsweeper | = 4.3.5 | No fix listed |
| clearswift mailsweeper | = 4.3.6 | No fix listed |
| clearswift mailsweeper | = 4.3.6_sp1 | No fix listed |
| clearswift mailsweeper | = 4.3.7 | No fix listed |
| clearswift mailsweeper | = 4.3.8 | No fix listed |
| clearswift mailsweeper | = 4.3.10 | No fix listed |
| clearswift mailsweeper | = 4.3.11 | No fix listed |
| clearswift mailsweeper | = 4.3.13 | No fix listed |
| f-secure anti-virus | = 4.51 | No fix listed |
| f-secure anti-virus | = 4.52 | No fix listed |
| f-secure anti-virus | = 4.60 | No fix listed |
| f-secure anti-virus | = 5.5 | No fix listed |
| f-secure anti-virus | = 5.41 | No fix listed |
| f-secure anti-virus | = 5.42 | No fix listed |
| f-secure anti-virus | = 5.52 | No fix listed |
| f-secure anti-virus | = 6.21 | No fix listed |
| f-secure anti-virus | = 2003 | No fix listed |
| f-secure anti-virus | = 2004 | No fix listed |
| f-secure for firewalls | = 6.20 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| f-secure internet security | = 2003 | No fix listed |
| f-secure internet security | = 2004 | No fix listed |
| f-secure personal express | = 4.5 | No fix listed |
| f-secure personal express | = 4.6 | No fix listed |
| f-secure personal express | = 4.7 | No fix listed |
| f-secure internet gatekeeper | = 6.31 | No fix listed |
| f-secure internet gatekeeper | = 6.32 | No fix listed |
| rarlab winrar | = 3.20 | No fix listed |
| redhat lha | = 1.14i-9 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| sgi propack | = 3.0 | No fix listed |
| stalker cgpmcafee | = 3.2 | No fix listed |
| tsugio okamoto lha | = 1.14 | No fix listed |
| tsugio okamoto lha | = 1.15 | No fix listed |
| tsugio okamoto lha | = 1.17 | No fix listed |
| winzip | = 9.0 | No fix listed |
| redhat fedora core | = core_1.0 | No fix listed |
References
- CLA-2004:840 vendor-advisory
- 20040501 LHa buffer overflows and directory traversal problems mailing-list
- 20040510 [Ulf Harnhammar]: LHA Advisory + Patch mailing-list
- GLSA-200405-02 vendor-advisory
- DSA-515 vendor-advisory
- FEDORA-2004-119 vendor-advisory
- RHSA-2004:178 vendor-advisory
- RHSA-2004:179 vendor-advisory
- 10243 exploit patch vdb-entry vendor-advisory
- FLSA:1833 vendor-advisory
- lha-directory-traversal(16013) vdb-entry
- oval:org.mitre.oval:def:10409 signature vdb-entry
- oval:org.mitre.oval:def:978 signature vdb-entry