Fedora Core 2 : lha-1.14i-14.1 (2004-295)

This script is Copyright (C) 2004-2015 Tenable Network Security, Inc.


Synopsis :

The remote Fedora Core host is missing a security update.

Description :

Lukasz Wojtow discovered a stack-based buffer overflow in all versions
of lha up to and including version 1.14. A carefully created archive
could allow an attacker to execute arbitrary code when a victim
extracts or tests the archive. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2004-0769
to this issue.

Buffer overflows were discovered in the command line processing of all
versions of lha up to and including version 1.14. If a malicious user
can trick a victim into passing a specially crafted command line to
the lha command, it is possible that arbitrary code could be executed.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2004-0771 and CVE-2004-0694 to these issues.

Thomas Biege discovered a shell meta character command execution
vulnerability in all versions of lha up to and including 1.14. An
attacker could create a directory with shell meta characters in its
name which could lead to arbitrary command execution. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CVE-2004-0745 to this issue.

Users of lha should update to this updated package

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues.

See also :

http://www.nessus.org/u?19b18310

Solution :

Update the affected lha and / or lha-debuginfo packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Fedora Local Security Checks

Nessus Plugin ID: 14693 (fedora_2004-295.nasl)

Bugtraq ID:

CVE ID: CVE-2004-0769

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now