CVE-2004-1027

2005-03-0105:00:00

mitre

web.nvd.nist.gov

cve-2004-1027

directory traversal

vulnerability

remote attackers

unarj

command line option

overwrite files

arj archive

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

AI Score

6.5

Confidence

Low

EPSS

0.003

Percentile

71.6%

JSON

Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain … (dot dot) sequences.

Affected configurations

Nvd

Node

arjsoftwareunarjMatch2.62

arjsoftwareunarjMatch2.63a

arjsoftwareunarjMatch2.64

arjsoftwareunarjMatch2.65

Node

gentoolinux

Node

debiandebian_linuxMatch3.0

VendorProductVersionCPE
arjsoftwareunarj2.62cpe:2.3:a:arjsoftware:unarj:2.62:*:*:*:*:*:*:*
arjsoftwareunarj2.63cpe:2.3:a:arjsoftware:unarj:2.63:a:*:*:*:*:*:*
arjsoftwareunarj2.64cpe:2.3:a:arjsoftware:unarj:2.64:*:*:*:*:*:*:*
arjsoftwareunarj2.65cpe:2.3:a:arjsoftware:unarj:2.65:*:*:*:*:*:*:*
gentoolinux*cpe:2.3:o:gentoo:linux:*:*:*:*:*:*:*:*
debiandebian_linux3.0cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
arjsoftware	unarj	2.62	cpe:2.3:a:arjsoftware:unarj:2.62:::::::*
arjsoftware	unarj	2.63	cpe:2.3:a:arjsoftware:unarj:2.63:a::::::
arjsoftware	unarj	2.64	cpe:2.3:a:arjsoftware:unarj:2.64:::::::*
arjsoftware	unarj	2.65	cpe:2.3:a:arjsoftware:unarj:2.65:::::::*
gentoo	linux	*	cpe:2.3:o:gentoo:linux::::::::
debian	debian_linux	3.0	cpe:2.3:o:debian:debian_linux:3.0:::::::*