Multiple directory traversal vulnerabilities in LHA 1.14 allow remote attackers or local users to create arbitrary files via an LHA archive containing filenames with (1) .. sequences or (2) absolute pathnames with double leading slashes ("//absolute/path").

Ulf Harnhammar discovered several vulnerabilities in LHa for UNIX's path name handling code. Specially constructed archive files may cause LHa to overwrite files or execute arbitrary code with the privileges of the user invoking LHa. This could be particularly harmful for automated systems that might handle archives such as virus scanning processes.

New bin- packages are available for Slackware 8.1, 9.0, 9.1, and
-current to fix buffer overflows and directory traversal vulnerabilities in the 'lha' archive utility. Sites using 'lha' should upgrade to the new bin package right away.

Two vulnerabilities were discovered in lha :

  - CAN-2004-0234 - Multiple stack-based buffer overflows in     the get_header function in header.c for LHA 1.14 allow     remote attackers or local users to execute arbitrary     code via long directory or file names in an LHA archive,     which triggers the overflow when testing or extracting     the archive.
  - CAN-2004-0235 - Multiple directory traversal     vulnerabilities in LHA 1.14 allow remote attackers or     local users to create arbitrary files via an LHA archive     containing filenames with (1) .. sequences or (2)     absolute pathnames with double leading slashes     ('//absolute/path').

The remote host is affected by the vulnerability described in GLSA-200405-02 (Multiple vulnerabilities in LHa)

    Ulf Harnhammar found two stack overflows and two directory traversal     vulnerabilities in LHa version 1.14 and 1.17. A stack overflow occurs when     testing or extracting archives containing long file or directory names.
    Furthermore, LHa doesn't contain sufficient protection against relative or     absolute archive paths.
  Impact :

    The stack overflows can be exploited to execute arbitrary code with the     rights of the user testing or extracting the archive. The directory     traversal vulnerabilities can be used to overwrite files in the filesystem     with the rights of the user extracting the archive, potentially leading to     denial of service or privilege escalation. Since LHa is often interfaced to     other software like an email virus scanner, this attack can be used     remotely.
  Workaround :

    There is no known workaround at this time. All users are advised to upgrade     to the latest available version of LHa.

Ulf Harnhammar discovered two stack-based buffer overflows and two directory traversal flaws in LHA. An attacker could exploit the buffer overflows by creating a carefully crafted LHA archive in such a way that arbitrary code would be executed when the archive is tested or extracted by a victim. CVE-2004-0234. An attacker could exploit the directory traversal issues to create files as the victim outside of the expected directory. CVE-2004-0235.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated LHA package that fixes several security vulnerabilities is now available.

LHA is an archiving and compression utility for LHarc format archives.

Ulf Harnhammar discovered two stack-based buffer overflows and two directory traversal flaws in LHA. An attacker could exploit the buffer overflows by creating a carefully crafted LHA archive in such a way that arbitrary code would be executed when the archive is tested or extracted by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0234 to this issue. An attacker could exploit the directory traversal issues to create files as the victim outside of the expected directory. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0235 to this issue.

Users of LHA should update to this updated package which contains backported patches not vulnerable to these issues.

Red Hat would like to thank Ulf Harnhammar for disclosing and providing test cases and patches for these issues.

ID	Name	Product	Family	Severity
36391	FreeBSD : lha buffer overflows and path traversal issues (a2ffb627-9c53-11d8-9366-0020ed76ef5a)	Nessus	FreeBSD Local Security Checks	critical
18762	Slackware 8.1 / 9.0 / 9.1 / current : lha update in bin package (SSA:2004-125-01)	Nessus	Slackware Local Security Checks	critical
15352	Debian DSA-515-1 : lha - several vulnerabilities	Nessus	Debian Local Security Checks	critical
14488	GLSA-200405-02 : Multiple vulnerabilities in LHa	Nessus	Gentoo Local Security Checks	critical
13697	Fedora Core 1 : lha-1.14i-12.1 (2004-119)	Nessus	Fedora Local Security Checks	critical
12491	RHEL 2.1 / 3 : lha (RHSA-2004:178)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2004-0235

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical