SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   unarj Vendors:   Jung, Robert K.
(Fedora Issues Fix for FC2) unarj Input Validation Bug May Let Remote Users Create/Overwrite Files on the Target User's System
SecurityTracker Alert ID:  1012199
SecurityTracker URL:  http://securitytracker.com/id/1012199
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Nov 12 2004
Impact:   Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.63a-7
Description:   An input validation vulnerability was reported in unarj. A remote user can create a malicious archive that, when expanded by a target user, will write arbitrary files on the target user's system.

doubles reported that a remote user can create a specially crafted archive that contains files with the '../' directory traversal characters in the path. When the target user expands the archive using the unarj 'x' command parameter, files on the target user's system may be created or potentially overwritten with the privileges of the target user.

From testing on version 2.43, it appears that files can be created using directory traversal characters but not overwritten.

Impact:   A remote user can create an archive that, when expanded by the target user, will create files on the target user's system with the privileges of the target user.

[Editor's note: It is not clear whether this flaw allows file overwriting. Some users claim so, others dispute the claim. Our testing of version 2.43 showed that only file creation was possible with that particular version.]

Solution:   Fedora has released a fix, available at:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

7cd2b05ac20893645d2d5307bec0bd44 SRPMS/unarj-2.63a-7.src.rpm
373d4ac8b936d388deeec2ef34195783 x86_64/unarj-2.63a-7.x86_64.rpm
8db05c7d97465cb809a520839799e69e x86_64/debug/unarj-
debuginfo-2.63a-7.x86_64.rpm
663a0b4cfa78c48f54ed531ed4ec5404 i386/unarj-2.63a-7.i386.rpm
dd4778dc2519de5b5dfb787a5f290ccf i386/debug/unarj-
debuginfo-2.63a-7.i386.rpm

Cause:   Access control error, Input validation error
Underlying OS:  Linux (Red Hat Fedora)
Underlying OS Comments:  FC2

Message History:   This archive entry is a follow-up to the message listed below.
Oct 11 2004 unarj Input Validation Bug May Let Remote Users Create Files on the Target User's System



 Source Message Contents

Subject:  [Security] Fedora Core 2 Update: unarj-2.63a-7


---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-414
2004-11-11
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : unarj
Version     : 2.63a                      
Release     : 7                  
Summary     : An uncompressor for .arj format archive files.
Description :
The UNARJ program is used to uncompress .arj format archives.  The .arj
format archive was mostly used on DOS machines.

Install the unarj package if you need to uncompress .arj format
archives.

---------------------------------------------------------------------
Update Information:

A buffer overflow bug has been discovered in unarj when handling long
file names contained in an archive. An attacker could create an archive
with a specially crafted path which could cause unarj to crash or
execute arbitrary instructions.  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0947 to
this issue.

Additionally, a path traversal vulnerability exists in unarj which
allows an attacker to extract files to the parent ("..") directory. When
used recursively, this vulnerability can be used to overwrite critical
system files and programs.

Users of unarj are advised to upgrade to these packages.
---------------------------------------------------------------------
* Wed Nov 10 2004 Lon Hohberger <lhh@redhat.com> 2.63a-7

- Fix directory traversal & buffer overflow. #138468

* Tue Jun 15 2004 Elliot Lee <sopwith@redhat.com>

- rebuilt


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

7cd2b05ac20893645d2d5307bec0bd44  SRPMS/unarj-2.63a-7.src.rpm
373d4ac8b936d388deeec2ef34195783  x86_64/unarj-2.63a-7.x86_64.rpm
8db05c7d97465cb809a520839799e69e  x86_64/debug/unarj-
debuginfo-2.63a-7.x86_64.rpm
663a0b4cfa78c48f54ed531ed4ec5404  i386/unarj-2.63a-7.i386.rpm
dd4778dc2519de5b5dfb787a5f290ccf  i386/debug/unarj-
debuginfo-2.63a-7.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------

--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC