CVE-2005-2670

Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via ".." sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/secunia_research/2005-24/advisory	Patch Vendor Advisory
http://www.globalhauri.com/html/download/down_unixpatch.html	Patch
http://securitytracker.com/id?1014740	Patch Vendor Advisory
http://secunia.com/advisories/15846	Patch Vendor Advisory
http://www.securityfocus.com/bid/14606

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hauri:livecall::::::::
	cpe:2.3:a:hauri:virobot_expert:4.0:::::::*
	cpe:2.3:a:hauri:virobot_advanced_server::::::::
	cpe:2.3:a:hauri:virobot_linux_server:2.0:::::::*

Information

Published : 2005-08-22 21:00

Updated : 2008-09-05 13:52

NVD link : CVE-2005-2670

Mitre link : CVE-2005-2670

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

hauri

virobot_advanced_server
livecall
virobot_expert
virobot_linux_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://secunia.com/secunia_research/2005-24/advisory", "name": "http://secunia.com/secunia_research/2005-24/advisory", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://www.globalhauri.com/html/download/down_unixpatch.html", "name": "http://www.globalhauri.com/html/download/down_unixpatch.html", "tags": ["Patch"], "refsource": "MISC"}, {"url": "http://securitytracker.com/id?1014740", "name": "1014740", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/15846", "name": "15846", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/14606", "name": "14606", "tags": [], "refsource": "BID"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in HAURI Anti-Virus products including ViRobot Expert 4.0, Advanced Server, Linux Server 2.0, and LiveCall allows remote attackers to overwrite arbitrary files via \"..\" sequences in filenames contained in (1) ACE, (2) ARJ, (3) CAB, (4) LZH, (5) RAR, (6) TAR and (7) ZIP files."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-2670", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-08-23T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:hauri:livecall:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hauri:virobot_expert:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hauri:virobot_advanced_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:hauri:virobot_linux_server:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-05T20:52Z"}