Bug 121417

Summary:	CAN-2004-0234/0235 lha security flaws
Product:	Red Hat Enterprise Linux 3	Reporter:	Mark J. Cox <mjc>
Component:	lha	Assignee:	Than Ngo <than>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	3.0	CC:	leonard-rh-bugzilla
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-05-26 07:46:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Mark J. Cox 2004-04-21 11:40:37 UTC

Ulf HÃ¤rnhammar discovered two stack buffer overflows and two directory
traversal flaws in LHA.  An attacker could exploit the buffer
overflows by creating a carefully crafted LHA archive in such a way
that arbitrary code would be executed when the archive is tested or
extracted by a victim.  CAN-2004-0234.  An attacker could exploit the
directory traversal issues to create files as the victim outside of
the expected directory.  CAN-2004-0235.

This issue is embargoed until April 29th 2004.         

CAN-2004-0234/5 Affects: 3AS 3ES 3WS

CAN-2004-0234/5 Affects: 2.1AS 2.1AW 2.1ES 2.1WS (1.00 of lha, not yet
investigated)

Comment 1 Mark J. Cox 2004-05-02 10:50:30 UTC

removing embargo

Comment 2 Leonard den Ottolander 2004-05-11 12:00:36 UTC

Mark, why don't you propagate these bugs to Fedora Core as well? I've
been mentioning this before, obviously without result.

If you are not responsible for Fedora Core security, then who is?

Comment 3 Mark J. Cox 2004-05-11 12:06:07 UTC

Yes; I opened about 10 security bugs into FC1 and FC2 earlier today
for tracking and updated our process document so we do so in the
future.  I didn't open one for lha since 1.14i-12.1 was built into
10-updates-candidate on May05 and will be available very soon.

Comment 4 Leonard den Ottolander 2004-05-11 12:17:29 UTC

Not opening a bug report because an update will be available soon is
not very transparent. Had I seen one I wouldn't have opened bug 123019...

Comment 5 Mark J. Cox 2004-05-26 07:46:03 UTC

An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-178.html