CVE-2004-0771 in Anti-Virus

Summary

Buffer overflow in the extract_one function from lhext.c in LHA may allow attackers to execute arbitrary code via a long w (working directory) command line option, a different issue than CVE-2004-0769. NOTE: this issue may be REJECTED if there are not any cases in which LHA is setuid or is otherwise used across security boundaries.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Reservation

08/04/2004

Disclosure

11/23/2004

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
1994	F-Secure Anti-Virus RAR Archive privileges management	269	Proof-of-Concept	Official fix	CVE-2004-0771
1993	F-Secure Anti-Virus ZIP Archive privileges management	269	Proof-of-Concept	Official fix	CVE-2004-0771

Sources

• MITRE
• NVD
• CVE Details