CVE-2006-0926

Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/19010	Vendor Advisory
http://www.hamid.ir/security/stuffit.txt
http://www.osvdb.org/23463
http://www.securityfocus.com/archive/1/425972/100/0/threaded
http://www.securityfocus.com/bid/16806
http://www.vupen.com/english/advisories/2006/0732
https://exchange.xforce.ibmcloud.com/vulnerabilities/24886

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:smithmicro:stuffit_deluxe:9.0:::::::*
	cpe:2.3:a:smithmicro:stuffit_expander:9.0.0.21_engine_9.0.0.21:::::::*
	cpe:2.3:a:smithmicro:stuffit_standard:9.0:::::::*
	cpe:2.3:a:smithmicro:zipmagic_deluxe:9.0:::::::*

History

No history.

Information

Published : 2006-02-28 11:02

Updated : 2024-02-28 10:42

NVD link : CVE-2006-0926

Mitre link : CVE-2006-0926

CVE.ORG link : CVE-2006-0926

JSON object : View

Products Affected

smithmicro

stuffit_standard
stuffit_deluxe
zipmagic_deluxe
stuffit_expander

CWE

NVD-CWE-Other

{"id": "CVE-2006-0926", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2006-02-28T11:02:00.000", "references": [{"url": "http://secunia.com/advisories/19010", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.hamid.ir/security/stuffit.txt", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/23463", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/425972/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/16806", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/0732", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24886", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive."}], "lastModified": "2018-10-18T16:29:47.617", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:smithmicro:stuffit_deluxe:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFCBEE5A-6227-42BB-BA7B-4EEC4D259050"}, {"criteria": "cpe:2.3:a:smithmicro:stuffit_expander:9.0.0.21_engine_9.0.0.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B3318D3A-DF5D-4EA2-8190-F88083796245"}, {"criteria": "cpe:2.3:a:smithmicro:stuffit_standard:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4FE5B10E-FE90-4502-8DF6-AC5DBF10BBAA"}, {"criteria": "cpe:2.3:a:smithmicro:zipmagic_deluxe:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3669E791-1022-491B-A831-D49ED84D32D7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}