9822 matches found
mailman -- generated passwords are poor quality
Florian Weimer wrote: Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password either by email or the web frontend. Knowledge of this password allows an attacker to gain access to the list archi...
Anti-virus software may not properly scan malformed zip archives
Overview Anti-virus software may rely on corrupted headers to determine if a zip archive is valid. As a result, anti-virus software may fail to detect malicious content within a zip archive. Description Information about a zip archive, such as the size of the compressed data, is placed in headers...
CVE-2004-1096
Archive::Zip (Perl) before 1.14 is affected; antivirus tools like amavisd-new can bypass protection by processing a ZIP with both local and global headers zeroed. The description notes the issue but does not specify fixed versions or patches in the provided sources. No exploitation details are gi...
CVE-2004-1096
Archive::Zip Perl module before 1.14, when used by antivirus programs such as amavisd-new, allows remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system...
CVE-2004-0947
CVE-2004-0947 is confirmed across connected docs as a vulnerability in the unarj utility. The issue is a buffer overflow when handling long filenames in arj archives, enabling remote code execution. Related advisories additionally describe a directory-traversal weakness in the -x extract option t...
FreeBSD : p5-Archive-Zip -- virus detection evasion (134)
The following package needs to be updated: p5-Archive-Zip %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkga5742055300a11d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyrigh...
unarj: Long filenames buffer overflow and a path traversal vulnerability
Background unarj is an ARJ archive decompressor. Description unarj has a bounds checking vulnerability within the handling of long filenames in archives. It also fails to properly sanitize paths when extracting an archive if the "x" option is used to preserve paths. Impact An attacker could trigg...
CVE-2004-1027
Directory traversal vulnerability in the -x extract command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. dot dot sequences...
PT-2004-1119 · Unarj · Unarj
Name of the Vulnerable Software and Affected Versions: unarj affected versions not specified Description: The issue is related to a directory traversal vulnerability in the -x extract command line option. This vulnerability allows remote attackers to overwrite arbitrary files by using an arj...
unarj buffer overflow
Buffer overflow on oversized archive filename...
Archive::Zip may not properly parse the file sizes of Zip archives
Overview Archive::Zip does not properly parse Zip files and may incorrectly interpret malformed zip archives to contain zero length/size files. As a a result, anti-virus software using Archive::Zip may fail to detect malicious content within a Zip archive. Description The Archive::Zip module allo...
WinRAR code execution
Undisclosured bug on archive repair...
Medium Risk Vulnerability in WinRAR
Peter Winter-Smith of NGSSoftware has discovered a medium risk vulnerability within the 'Repair Archive' feature in WinRAR. WinRAR versions 3.40 and older are vulnerable to this issue. This vulnerability has now been fixed by RARLabs in WinRAR version 3.41, and a fix can be downloaded from the...
Mandrake Linux Security Advisory : perl-Archive-Zip (MDKSA-2004:118)
Recently, it was noticed that several antivirus programs miss viruses that are contained in ZIP archives with manipulated directory data. The global archive directory of these ZIP file have been manipulated to indicate zero file sizes. Archive::Zip produces files of zero length when decompressing...
GLSA-200410-31 : Archive::Zip: Virus detection evasion
The remote host is affected by the vulnerability described in GLSA-200410-31 Archive::Zip: Virus detection evasion Archive::Zip can be used by email scanning software like amavisd-new to uncompress attachments before virus scanning. By modifying the uncompressed size of archived files in the glob...
Archive::Zip: Virus detection evasion
Background Archive::Zip is a Perl module containing functions to handle ZIP archives. Description Archive::Zip can be used by email scanning software like amavisd-new to uncompress attachments before virus scanning. By modifying the uncompressed size of archived files in the global header of the...
iDEFENSE Security Advisory 10.18.04: Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability
Multiple Vendor Anti-Virus Software Detection Evasion Vulnerability iDEFENSE Security Advisory 10.18.04 www.idefense.com/application/poi/display?id=153&type=vulnerabilities October 18, 2004 I. BACKGROUND This vulnerability affects multiple anti-virus vendors including McAfee, Computer Associates,...
unzoo -- Directory Traversal Vulnerability
Secunia reports: Doubles has discovered a vulnerability in Unzoo, which potentially can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to an input validation error when unpacking archives. This can be exploited via a directory traversal attack to...
p5-Archive-Zip -- virus detection evasion
An AMaViS Security Announcement reports that a vulnerability exist in the Archive::Zip Perl module which may lead to bypass of malicious code in anti-virus programs by creating specially crafted ZIP files...
