JVNDB-2004-000170

Lha Directory Traversal Vulnerability in Testing and Extracting Process

LHa for UNIX is vulnerable to directory traversal due to improper path validation when testing or extracting an archive.

LHa for UNIX project

• LHa for UNIX 1.17 and earlier

Red Hat, Inc.

• Red Hat Enterprise Linux 2.1 (as)
• Red Hat Enterprise Linux 3 (as)
• Red Hat Enterprise Linux 2.1 (es)
• Red Hat Enterprise Linux 3 (es)
• Red Hat Enterprise Linux 2.1 (ws)
• Red Hat Enterprise Linux 3 (ws)
• Red Hat Enterprise Linux Desktop 3.0
• Red Hat Linux 9
• Red Hat Linux Advanced Workstation 2.1

An attacker could bypass access restriction and create arbitrary files in the directories for which he has no permission.

Please refer to the 'Vendor Information' section for official remediation and take appropriate action.

LHa for UNIX project

• LHA for UNIX : LHA for UNIX Version 1.17
• LHA for UNIX : Top Page

Red Hat, Inc.

• Red Hat Security Advisory : RHSA-2004:178
• Red Hat Security Advisory : RHSA-2004:179

1. CVE-2004-0235

1. National Vulnerability Database (NVD) : CVE-2004-0235
2. Open Vulnerability and Assessment Language (OVAL) : 978
3. SecurityFocus : 10243
4. SecurityFocus : LHA Advisory + Patch (marc.info)
5. ISS X-Force Database : 16013

• [2008/05/21]
    Web page published