MitreCVELIST:CVE-2004-1094CVE-2004-1094
Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same.
References
archives.neohapsis.com/archives/fulldisclosure/2004-10/1044.html
marc.info/?l=bugtraq&m=109894226007607&w=2
secunia.com/advisories/17096
secunia.com/advisories/17394
secunia.com/advisories/18194
secunia.com/advisories/19451
securityreason.com/securityalert/296
securityreason.com/securityalert/653
securitytracker.com/id?1011944
securitytracker.com/id?1012297
securitytracker.com/id?1016817
service.real.com/help/faq/security/041026_player/EN/
www.kb.cert.org/vuls/id/582498
www.networksecurity.fi/advisories/dtsearch.html
www.networksecurity.fi/advisories/lotus-notes.html
www.networksecurity.fi/advisories/mcafee-virusscan.html
www.networksecurity.fi/advisories/multiledger.html
www.networksecurity.fi/advisories/payroll.html
www.osvdb.org/19906
www.securiteam.com/windowsntfocus/6Z00W00EAM.html
www.securityfocus.com/archive/1/420274/100/0/threaded
www.securityfocus.com/archive/1/429361/100/0/threaded
www.securityfocus.com/archive/1/445369/100/0/threaded
www.securityfocus.com/bid/11555
www.vupen.com/english/advisories/2005/2057
www.vupen.com/english/advisories/2006/1176
exchange.xforce.ibmcloud.com/vulnerabilities/17879
exchange.xforce.ibmcloud.com/vulnerabilities/22737
Related
