miniunzip 'minizip.c' Directory Traversal Vulnerability
BID:71846
CVE-2014-9485 |Info
miniunzip 'minizip.c' Directory Traversal Vulnerability
| Bugtraq ID: | 71846 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9485 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 31 2014 12:00AM |
| Updated: | Jan 06 2015 12:05AM |
| Credit: | Jakub Wilk |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
miniunzip 'minizip.c' Directory Traversal Vulnerability
miniunzip is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Information obtained could aid in further attacks.
miniunzip 1.1-3 is vulnerable.
miniunzip is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application. Information obtained could aid in further attacks.
miniunzip 1.1-3 is vulnerable.
Exploit / POC
miniunzip 'minizip.c' Directory Traversal Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
miniunzip 'minizip.c' Directory Traversal Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
miniunzip 'minizip.c' Directory Traversal Vulnerability
References:
References: