Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
BID:13083
Info
Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
| Bugtraq ID: | 13083 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1080 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2005 12:00AM |
| Updated: | Jul 15 2015 12:09AM |
| Credit: | Discovery is credited to Pluf <[email protected]>. |
| Vulnerable: |
Sun SDK (Linux Production Release) 1.5 Sun SDK (Linux Production Release) 1.4.2 Red Hat Enterprise Linux Workstation Supplementary 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Server Supplementary 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Supplementary 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 5 client Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 5 CentOS CentOS 5 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 |
| Not Vulnerable: | |
Discussion
Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
The Java Archive Tool is reported vulnerable to a directory traversal vulnerability.
An attacker can supply a malicious archive containing files named with '../' directory traversal sequences, which can potentially overwrite existing data during extraction.
Sun Java 2 Standard Edition versions 1.5.0 and 1.4.2 for both Linux and Microsoft Windows platforms are reported vulnerable. Other vendors using the technology may be affected as well.
The Java Archive Tool is reported vulnerable to a directory traversal vulnerability.
An attacker can supply a malicious archive containing files named with '../' directory traversal sequences, which can potentially overwrite existing data during extraction.
Sun Java 2 Standard Edition versions 1.5.0 and 1.4.2 for both Linux and Microsoft Windows platforms are reported vulnerable. Other vendors using the technology may be affected as well.
Exploit / POC
Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
An exploit is not required.
An exploit is not required.
Solution / Fix
Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Sun J2SE Software Development Kit Java Archive Tool Directory Traversal Vulnerability
References:
References:
- J2SE Product Page (Sun)