full-disclosure - unarj dir-transversal bug (../../../..)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <200410120757.i9C7vo38028937@mailserver2.hushmail.com>
From: doubles at hush.com (doubles@...h.com)
Subject: unarj dir-transversal bug (../../../..)

On Mon, 11 Oct 2004 16:29:40 -0700 evilninja <evilninja@....net> wrote:
>evil@...ep:~$ unarj x test.arj
>ARJ32 v 3.10, Copyright (c) 1998-2004, ARJ Software Russia. [27
>Jun 2004]

arj != unarj! debian is stubido dist nd it pakage ''arj'' as ''unarj''!

real unarj 2.* inkl 2.65 latest are vunerabble!

doubles




Concerned about your privacy? Follow this link to get
secure FREE email: http://www.hushmail.com/?l=2

Free, ultra-private instant messaging with Hush Messenger
http://www.hushmail.com/services-messenger?l=434

Promote security and make money with the Hushmail Affiliate Program: 
http://www.hushmail.com/about-affiliate?l=427