CVE-2001-1268 - Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite a

CVE-2001-1268

Summary

Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.

References

http://online.securityfocus.com/archive/1/196445
http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1
http://www.info-zip.org/pub/infozip/UnZip.html

Vulnerable Configurations

cpe:2.3:a:info-zip:unzip:*:*:*:*:*:*:*:*
cpe:2.3:a:info-zip:unzip:*:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 25-05-2010 - 04:10)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:N/I:P/A:N

refmap via4

bugtraq	20010712 SECURITY.NNOV: directory traversal and path globing in multiple archivers
confirm	http://www.info-zip.org/pub/infozip/UnZip.html
sunalert	1000928 47800

Last major update

25-05-2010 - 04:10

Published

12-07-2001 - 04:00

Last modified

25-05-2010 - 04:10