Bug 138836

Summary: CAN-2004-1027 unarj directory traversal issue
Product: [Fedora] Fedora Reporter: Josh Bressers <bressers>
Component: unarjAssignee: Lon Hohberger <lhh>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: medium    
Version: 2Keywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,reported=20041109
Fixed In Version: 2.63a-7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-11-11 19:20:22 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Demo exploit for this issue. none

Description Josh Bressers 2004-11-11 14:55:33 UTC 
This message was posted to full-disclosure

http://lists.netsys.com/pipermail/full-disclosure/2004-October/027348.html

after decoding it, it basically says there is a directory traversal
hole in unarj.

It is possible for an attacker to create a specially crafted arj
archive, which when a user extracts with the x flag, it is possible
for a file to be placed anywhere the user running arj has write
permissions.
Comment 1 Josh Bressers 2004-11-11 14:57:01 UTC 
Created attachment 106504 [details]
Demo exploit for this issue.

You have to give unarj the 'x' option to see the result of this exploit.  It
will try to stick a file in /etc called foo.