CLA-2003:672Vendor advisory
http://distro.conectiva.com.br/atualizacoes?id=a&anuncio=000672 CVE-2003-0282
Info-ZIP UnZip 5.50 - Encoded Character Hostile Destination Path
Record summary
CVE-2003-0282 has a selected CVSS score of 2.6; EIP currently links 1 catalogued exploit and 1 repository PoC.
Description
Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.
Description source: CVE List
Exploitation context
Proofs of concept
2Catalogued exploits
ExploitDBInfo-ZIP UnZip 5.50 - Encoded Character Hostile Destination PathExploitDB exploitby JelmerNot analyzed1 file
Repository PoCs
GitHubsionnx/cve-2003-0282Repository PoCby sionnxStars: 0Not analyzed353 files
References
Showing 12 of 15IMNX-2003-7+-017-01Vendor advisory
http://download.immunix.org/ImmunixOS/7+/Updates/errata/IMNX-2003-7+-017-01 20030509 unzip directory traversal revisitedmailing list
http://marc.info/?l=bugtraq&m=105259038503175&w=2 20030710 [OpenPKG-SA-2003.033] OpenPKG Security Advisory (infozip)mailing list
http://marc.info/?l=bugtraq&m=105786446329347&w=2 N-111Third-party advisoryGovernment resource
http://www.ciac.org/ciac/bulletins/n-111.shtml DSA-344Vendor advisory
http://www.debian.org/security/2003/dsa-344 info-zip.orgConfirmation
http://www.info-zip.org/FAQ.html MDKSA-2003:073Vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2003:073 RHSA-2003:199Vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-199.html RHSA-2003:200Vendor advisory
http://www.redhat.com/support/errata/RHSA-2003-200.html 7550vdb entry
http://www.securityfocus.com/bid/7550 TLSA-2003-42Vendor advisory
http://www.turbolinux.com/security/TLSA-2003-42.txt