unalz文件名处理目录遍历漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195756 漏洞类型 路径遍历
发布时间 2006-03-14 更新时间 2006-03-16
CVE编号 CVE-2006-0950 CNNVD-ID CNNVD-200603-220
漏洞平台 N/A CVSS评分 2.6
|漏洞来源
https://www.securityfocus.com/bid/17105
https://cxsecurity.com/issue/WLB-2006030067
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-220
|漏洞详情
unalz是ALZ文档的解压程序。unalz在解压ALZ文档时存在输入验证错误,攻击者可以使用"../"目录遍历序列将文件解压到指定目录之外的任意位置。
|漏洞EXP
======================================================================

Secunia Research 13/03/2006

- unalz Filename Handling Directory Traversal Vulnerability -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9

====================================================================== 
1) Affected Software

* unalz version 0.53.

Other versions may also be affected.

====================================================================== 
2) Severity

Rating: Less Critical
Impact: System access
Where:  Remote

====================================================================== 
3) Description of Vulnerability

Secunia Research has discovered a vulnerability in unalz, which
potentially can be exploited by malicious people to compromise a
user's system.

The vulnerability is caused due to an input validation error when
extracting an ALZ archive. This makes it possible to have files
extracted to arbitrary locations outside the specified directory
using the "../" directory traversal sequence.

The vulnerability has been confirmed in version 0.53. Other version
may also be affected.

====================================================================== 
4) Solution

Update to version 0.55.

====================================================================== 
5) Time Table

02/03/2006 - Initial vendor notification.
10/03/2006 - Initial vendor reply.
13/03/2006 - Public disclosure.

====================================================================== 
6) Credits

Discovered by Tan Chew Keong, Secunia Research.

====================================================================== 
7) References

The Common Vulnerabilities and Exposures (CVE) project has assigned
CVE-2006-0950 for the vulnerability.

====================================================================== 
8) About Secunia

Secunia collects, validates, assesses, and writes advisories regarding 
all the latest software vulnerabilities disclosed to the public. These 
advisories are gathered in a publicly available database at the 
Secunia website:

http://secunia.com/

Secunia offers services to our customers enabling them to receive all 
relevant vulnerability information to their specific system 
configuration.

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/secunia_security_advisories/

====================================================================== 
9) Verification

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2006-16/advisory/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================
|受影响的产品
www.kipple.pe.kr unalz 0.53
|参考资料

来源:BUGTRAQ
名称:20060313SecuniaResearch:unalzFilenameHandlingDirectoryTraversalVulnerability
链接:http://www.securityfocus.com/archive/1/archive/1/427475/100/0/threaded
来源:VUPEN
名称:ADV-2006-0938
链接:http://www.frsirt.com/english/advisories/2006/0938
来源:SECUNIA
名称:19063
链接:http://secunia.com/advisories/19063
来源:XF
名称:unalz-archive-directory-traversal(25171)
链接:http://xforce.iss.net/xforce/xfdb/25171
来源:BID
名称:17105
链接:http://www.securityfocus.com/bid/17105
来源:OSVDB
名称:23835
链接:http://www.osvdb.org/23835
来源:SECTRACK
名称:1015780
链接:http://securitytracker.com/id?1015780
来源:MISC
链接:http://secunia.com/secunia_research/2006-16/
来源:FULLDISC
名称:20060313SecuniaResearch:unalzFilenameHandling
链接:http://marc.theaimsgroup.com/?l=full-disclosure&m=114226632422033&w=2
来源:SREASON
名称:575
链接:http://securityreason.com/securityalert/575