CVE-2004-1027 Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequ...
MediumCVSS 5.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| arjsoftware unarj | = 2.62 | No fix listed |
| arjsoftware unarj | = 2.63-a | No fix listed |
| arjsoftware unarj | = 2.64 | No fix listed |
| arjsoftware unarj | = 2.65 | No fix listed |
| gentoo linux | All versions | No fix listed |
| debian linux | = 3.0 | No fix listed |
References
- 20041010 unarj dir-transversal bug (../../../..) mailing-list third-party-advisory
- FLSA:2272 third-party-advisory vendor-advisory
- GLSA-200411-29 third-party-advisory vendor-advisory
- DSA-628 third-party-advisory vendor-advisory
- DSA-652 third-party-advisory vendor-advisory
- RHSA-2005:007 third-party-advisory vendor-advisory
- 11436 patch third-party-advisory vdb-entry vendor-advisory
- unarj-directory-traversal(17684) vdb-entry
- Debian Security Tracker CVE-2004-1027 vendor-advisory