This script is Copyright (C) 2004-2014 Tenable Network Security, Inc.
The remote Red Hat host is missing a security update.
Updated unzip packages resolving a vulnerability allowing arbitrary
files to be overwritten are now available.
[Updated 15 August 2003] Ben Laurie found that the original patch to
fix this issue missed a case where the path component included a
quoted slash. These updated packages contain a new patch that corrects
The unzip utility is used for manipulating archives, which are
multiple files stored inside of a single file.
A vulnerabilitiy in unzip version 5.50 and earlier allows attackers to
overwrite arbitrary files during archive extraction by placing invalid
(non-printable) characters between two '.' characters. These
non-printable characters are filtered, resulting in a '..' sequence.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2003-0282 to this issue.
This erratum includes a patch ensuring that non-printable characters
do not make it possible for a malicious .zip file to write to parent
directories unless the '-:' command line parameter is specified.
Users of unzip are advised to upgrade to these updated packages, which
are not vulnerable to this issue.
See also :
Update the affected unzip package.
Risk factor :
Low / CVSS Base Score : 2.6
Family: Red Hat Local Security Checks
Nessus Plugin ID: 12403 ()
CVE ID: CVE-2003-0282
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.