Vulnerability Scanning Solutions, LLC.
Home
Our Process
Residential
Corporate
What We Scan For
Sample Report
Client List
Terms
Contact Us
What We Scan For
Family: Red Hat Local Security Checks --> Category: infos

RHSA-2005-007: unarj Vulnerability Scan


Vulnerability Scan Summary
Check for the version of the unarj packages

Detailed Explanation for this Vulnerability Test


An updated unarj package that fixes a buffer overflow vulnerability and a
directory traversal vulnerability is now available.

The unarj program is an archiving utility which can extract ARJ-compatible
archives.

A buffer overflow bug was discovered in unarj when handling long file
names contained in an archive. A possible hacker could create a specially
crafted archive which could cause unarj to crash or possibly execute
arbitrary code when extracted by a victim. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0947 to
this issue.

Additionally, a path traversal vulnerability was discovered in unarj. An
attacker could create a specially crafted archive which would create files
in the parent ("..") directory when extracted by a victim. When used
recursively, this vulnerability could be used to overwrite critical system
files and programs. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-1027 to this issue.

Users of unarj should upgrade to this updated package which contains
backported patches and is not vulnerable to these issues.




Solution : http://rhn.redhat.com/errata/RHSA-2005-007.html
Threat Level: High

Click HERE for more information and discussions on this network vulnerability scan.

VSS, LLC.

P.O. Box 827051

Pembroke Pines, FL 33082-7051

Vulnerability Scanning Solutions, LLC.