This script is Copyright (C) 2004-2014 Tenable Network Security, Inc.
The remote Red Hat host is missing a security update.
An updated lha package that fixes a buffer overflow is now available.
LHA is an archiving and compression utility for LHarc format archives.
Lukasz Wojtow discovered a stack-based buffer overflow in all versions
of lha up to and including version 1.14. A carefully created archive
could allow an attacker to execute arbitrary code when a victim
extracts or tests the archive. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0769
to this issue.
Buffer overflows were discovered in the command line processing of all
versions of lha up to and including version 1.14. If a malicious user
can trick a victim into passing a specially crafted command line to
the lha command, it is possible that arbitrary code could be executed.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2004-0771 and CVE-2004-0694 to these issues.
Thomas Biege discovered a shell meta character command execution
vulnerability in all versions of lha up to and including 1.14. An
attacker could create a directory with shell meta characters in its
name which could lead to arbitrary command execution. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0745 to this issue.
Users of lha should update to this updated package which contains
backported patches and is not vulnerable to these issues.
See also :
Update the affected lha package.
Risk factor :
Critical / CVSS Base Score : 10.0