Vulnerability CVE-2015-0557
Published: 2015-04-08

Description:
Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.8/10
4.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial
Affected software
Fedoraproject -> Fedora 
Arj software -> Arj archiver 

 References:
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154518.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154605.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155011.html
http://www.debian.org/security/2015/dsa-3213
http://www.mandriva.com/security/advisories?name=MDVSA-2015:201
http://www.openwall.com/lists/oss-security/2015/01/03/5
http://www.openwall.com/lists/oss-security/2015/01/05/9
http://www.securityfocus.com/bid/71895
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774435
https://security.gentoo.org/glsa/201612-15
Copyright 2024, cxsecurity.com

 

Back to Top