Open-source ARJ archiver 3.10.22 does not properly remove leading slashes from paths, which allows remote attackers to conduct absolute path traversal attacks and write to arbitrary files via multiple leading slashes in a path in an ARJ archive.

Several vulnerabilities: symlink directory traversal, absolute path directory traversal and buffer overflow were discovered in the arj archiver.

The remote host is affected by the vulnerability described in GLSA-201612-15 (ARJ: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ARJ. Please review the       CVE identifiers referenced below for details.
  Impact :

    An attacker, using a specially crafted ARJ archive, could possibly       execute arbitrary code with the privileges of the process, or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

- Added patch from Debian to avoid free on invalid pointer     due to a buffer overflow (#1196751, #1207180)

    - Added patch from Debian for symlink directory       traversal (#1178824)

    - Added patch from Debian to fix the directory traversal       via //multiple/leading/slash (#1178824)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been found and corrected in arj :

Jakub Wilk discovered that arj follows symlinks created during unpacking of an arj archive. A remote attacker could use this flaw to perform a directory traversal attack if a user or automated system were tricked into processing a specially crafted arj archive (CVE-2015-0556).

Jakub Wilk discovered that arj does not sufficiently protect from directory traversal while unpacking an arj archive containing file paths with multiple leading slashes. A remote attacker could use this flaw to write to arbitrary files if a user or automated system were tricked into processing a specially crafted arj archive (CVE-2015-0557).

Jakub Wilk and Guillem Jover discovered a buffer overflow vulnerability in arj. A remote attacker could use this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the user running arj (CVE-2015-2782).

The updated packages provides a solution for these security issues.

Multiple vulnerabilities have been discovered in arj, an open source version of the arj archiver. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2015-0556

Jakub Wilk discovered that arj follows symlinks created during unpacking of an arj archive. A remote attacker could use this flaw to perform a directory traversal attack if a user or automated system were tricked into processing a specially crafted arj archive.

CVE-2015-0557

Jakub Wilk discovered that arj does not sufficiently protect from directory traversal while unpacking an arj archive containing file paths with multiple leading slashes. A remote attacker could use this flaw to write to arbitrary files if a user or automated system were tricked into processing a specially crafted arj archive.

CVE-2015-2782

Jakub Wilk and Guillem Jover discovered a buffer overflow vulnerability in arj. A remote attacker could use this flaw to cause an application crash or, possibly, execute arbitrary code with the privileges of the user running arj.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in arj, an open source version of the arj archiver. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-0556     Jakub Wilk discovered that arj follows symlinks created     during unpacking of an arj archive. A remote attacker     could use this flaw to perform a directory traversal     attack if a user or automated system were tricked into     processing a specially crafted arj archive.

  - CVE-2015-0557     Jakub Wilk discovered that arj does not sufficiently     protect from directory traversal while unpacking an arj     archive containing file paths with multiple leading     slashes. A remote attacker could use this flaw to write     to arbitrary files if a user or automated system were     tricked into processing a specially crafted arj archive.

  - CVE-2015-2782     Jakub Wilk and Guillem Jover discovered a buffer     overflow vulnerability in arj. A remote attacker could     use this flaw to cause an application crash or,     possibly, execute arbitrary code with the privileges of     the user running arj.

ID	Name	Product	Family	Severity
103999	FreeBSD : arj -- multiple vulnerabilities (b95e5674-b4d6-11e7-b895-0cc47a494882)	Nessus	FreeBSD Local Security Checks	high
95548	GLSA-201612-15 : ARJ: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
82962	Fedora 22 : arj-3.10.22-22.fc22 (2015-5524)	Nessus	Fedora Local Security Checks	high
82752	Fedora 20 : arj-3.10.22-22.fc20 (2015-5546)	Nessus	Fedora Local Security Checks	high
82736	Mandriva Linux Security Advisory : arj (MDVSA-2015:201)	Nessus	Mandriva Local Security Checks	high
82731	Fedora 21 : arj-3.10.22-22.fc21 (2015-5603)	Nessus	Fedora Local Security Checks	high
82645	Debian DLA-188-1 : arj security update	Nessus	Debian Local Security Checks	high
82595	Debian DSA-3213-1 : arj - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-0557

high

Tenable Plugins

high

high

high

high

high

high

high

high