CVE-2002-1139

The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP files, which allows attackers to place an executable file in a known location on a user's system, aka "Incorrect Target Path for Zipped File Decompression."

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.iss.net/security_center/static/10252.php	Vendor Advisory
http://www.securityfocus.com/bid/5876
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054
http://www.iss.net/security_center/static/10252.php	Vendor Advisory
http://www.securityfocus.com/bid/5876
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:windows_98_plus_pack::::::::
	cpe:2.3:o:microsoft:windows_me::::::::
	cpe:2.3:o:microsoft:windows_xp:::home:::::*
	cpe:2.3:o:microsoft:windows_xp::gold:professional:::::
	cpe:2.3:o:microsoft:windows_xp::sp1:home:::::

History

20 Nov 2024, 23:40

Type	Values Removed	Values Added
References	~~() http://www.iss.net/security_center/static/10252.php - Vendor Advisory~~	() http://www.iss.net/security_center/static/10252.php - Vendor Advisory
References	~~() http://www.securityfocus.com/bid/5876 -~~	() http://www.securityfocus.com/bid/5876 -
References	~~() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054 -~~	() https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054 -

Information

Published : 2002-10-11 04:00

Updated : 2024-11-20 23:40

NVD link : CVE-2002-1139

Mitre link : CVE-2002-1139

CVE.ORG link : CVE-2002-1139

JSON object : View

Products Affected

microsoft

windows_me
windows_98_plus_pack
windows_xp

CWE

NVD-CWE-Other

{"id": "CVE-2002-1139", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2002-10-11T04:00:00.000", "references": [{"url": "http://www.iss.net/security_center/static/10252.php", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/5876", "source": "cve@mitre.org"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054", "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/10252.php", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/5876", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-054", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The Compressed Folders feature in Microsoft Windows 98 with Plus! Pack, Windows Me, and Windows XP does not properly check the destination folder during the decompression of ZIP files, which allows attackers to place an executable file in a known location on a user's system, aka \"Incorrect Target Path for Zipped File Decompression.\""}, {"lang": "es", "value": "La caracter\u00edstica de Carpetas Comprimidas en Microsoft Windows 98 con el paquete Plus!, Windows Me, y Windows XP no comprueba adecuadamente la carpeta de destino durante la descompresi\u00f3n de ficheros ZIP, lo que permite a atacantes remotos poner un fichero ejecutable en una lugar conocido en el sistema del usuario, tambi\u00e9n conocida como \"Ruta Objetivo Incorrecta en Descompresi\u00f3n de Ficheros Zipeados\"."}], "lastModified": "2024-11-20T23:40:40.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:windows_98_plus_pack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83DE6302-A76A-44C1-A2EC-27FD1B82B9B7"}, {"criteria": "cpe:2.3:o:microsoft:windows_me:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "799DA395-C7F8-477C-8BC7-5B4B88FB7503"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:home:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BC176BB0-1655-4BEA-A841-C4158167CC9B"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:gold:professional:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BF263CB-4239-4DB0-867C-9069ED02CAD7"}, {"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp1:home:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "49693FA0-BF34-438B-AFF2-75ACC8A6D2E6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}