CVE-2004-0234

Description

Multiple stack-based buffer overflows in the get_header function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9881

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A977

https://exchange.xforce.ibmcloud.com/vulnerabilities/16012

https://bugzilla.fedora.us/show_bug.cgi?id=1833

http://www.vupen.com/english/advisories/2006/1220

http://www.redhat.com/support/errata/RHSA-2004-179.html

http://www.redhat.com/support/errata/RHSA-2004-178.html

http://www.redhat.com/archives/fedora-announce-list/2004-May/msg00005.html

http://www.osvdb.org/5754

http://www.osvdb.org/5753

http://www.guay-leroux.com/projects/barracuda-advisory-LHA.txt

http://www.debian.org/security/2004/dsa-515

http://securitytracker.com/id?1015866

http://security.gentoo.org/glsa/glsa-200405-02.xml

http://secunia.com/advisories/19514

http://marc.info/?l=bugtraq&m=108422737918885&w=2

http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020778.html

http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/020776.html

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000840

http://archives.neohapsis.com/archives/bugtraq/2006-04/0059.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3