Stuffit and ZipMagic archive directory traversal
| stuffit-zipmagic-archive-directory-traversal (24886) |  Medium Risk |
Description:
Stuffit and ZipMagic could allow a remote attacker to traverse directories on the system. A remote attacker could exploit this vulnerability by creating a specially-crafted .tar or .zip archive, which would allow the attacker to traverse directories and overwrite arbitrary files on a victim's system, if the attacker could persuade the victim to download and extract the malicious archive.
Consequences:
Data Manipulation
Remedy:
No remedy available as of July 9, 2011.
References:
- BugTraq Mailing List, Fri Feb 24 2006 - 07:59:49 CST: StuffIt and ZipMagic Family of products Directory traversal.
- StuffIt Deluxe Web site: StuffIt Deluxe 9.0 for Windows - Access Anything, Compress Everything - Even Photos!.
- StuffIt Expander Web site: StuffIt Expander 9.0 for Windows - Access Anything, Compress Everything - Even Photos!.
- StuffIt Standard Web site: StuffIt Standard 9.0 for Windows - Access Anything, Compress Everything - Even Photos!.
- ZipMagic Deluxe Web site: ZipMagic Deluxe 9.0 for Windows - Access Anything, Compress Everything - Even Photos!.
- BID-16806: StuffIt and ZipMagic Remote Directory Traversal Vulnerability
- CVE-2006-0926: Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.
- OSVDB ID: 23463: StuffIt / ZipMagic Archive Traversal Arbitrary File Overwrite
- SA19010: StuffIt / ZipMagic Directory Traversal Vulnerability
- VUPEN/ADV-2006-0732: StuffIt and ZipMagic ZIP and TAR Archive Directory Traversal Vulnerability
Platforms Affected:
- Stuffit Stuffit Deluxe 9.0
- Stuffit Stuffit Expander 9.0.0.21
- Stuffit Stuffit Standard 9.0.0.21
- Stuffit ZipMagic Deluxe 9.0
Reported:
Feb 24, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net