|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
 |
Vulnerability Note VU#871497
Lhaca buffer overflow vulnerability
OverviewThe Lhaca archiving program contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code.
I. DescriptionLHA is an archive file format. LHA is used by the Lhaca compression utility.
A stack buffer overflow vulnerability exists in the Lhaca program. This vulnerability occurs due to insuffiecient bounds checking. Note that there are reports that this vulnerability is being publicly exploited.
II. ImpactA remote, unauthenticated attacker may be able to execute arbitrary code, or create a denial-of-service condition.
III. SolutionUpgrade
The vendor has released Lhaca version 1.23 to address this issue. Users are encouraged to upgrade as soon as possible.
Systems Affected
| Vendor | Status | Date Notified | Date Updated |
|---|
| 3com, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Aladdin Knowledge Systems | Unknown | 2007-07-05 | 2007-07-05 |
| Apple Computer, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Bro | Not Vulnerable | 2007-07-05 | 2007-07-13 |
| Check Point Software Technologies | Unknown | 2007-07-05 | 2007-07-05 |
| Cisco Systems, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Command Software Systems | Not Vulnerable | 2007-07-05 | 2007-07-24 |
| Computer Associates | Not Vulnerable | 2007-07-05 | 2009-01-16 |
| Computer Associates eTrust Security Management | Not Vulnerable | 2007-07-05 | 2009-01-16 |
| Conectiva Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Cray Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| CyberSoft, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| DataFellows | Unknown | 2007-07-05 | 2007-07-05 |
| Debian GNU/Linux | Not Vulnerable | 2007-07-05 | 2007-07-31 |
| EMC Corporation | Unknown | 2007-07-05 | 2007-07-05 |
| Engarde Secure Linux | Unknown | 2007-07-05 | 2007-07-05 |
| Enterasys Networks | Unknown | 2007-07-05 | 2007-07-05 |
| F-PROT by FRISK Software International | Unknown | 2007-07-05 | 2007-07-05 |
| F-Secure Corporation | Not Vulnerable | 2007-07-05 | 2007-07-17 |
| F5 Networks, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Fedora Project | Unknown | 2007-07-05 | 2007-07-05 |
| Finjan Software | Unknown | 2007-07-05 | 2007-07-05 |
| Fortinet, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| FreeBSD, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Fujitsu | Unknown | 2007-07-05 | 2007-07-05 |
| Gentoo Linux | Unknown | 2007-07-05 | 2007-07-05 |
| GFI Software, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Hewlett-Packard Company | Unknown | 2007-07-05 | 2007-07-05 |
| Hitachi | Unknown | 2007-07-05 | 2007-07-05 |
| IBM Corporation | Unknown | 2007-07-05 | 2007-07-05 |
| IBM Corporation (zseries) | Unknown | 2007-07-05 | 2007-07-05 |
| IBM eServer | Unknown | 2007-07-05 | 2007-07-05 |
| Immunix Communications, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Ingrian Networks, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Internet Security Systems, Inc. | Not Vulnerable | 2007-07-05 | 2007-07-09 |
| Juniper Networks, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| lhaca | Vulnerable | | 2007-07-06 |
| Mandriva, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| McAfee | Unknown | 2007-07-05 | 2007-07-05 |
| MessageLabs | Unknown | 2007-07-05 | 2007-07-05 |
| Microsoft Corporation | Not Vulnerable | 2007-07-05 | 2007-07-09 |
| MontaVista Software, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| NEC Corporation | Unknown | 2007-07-05 | 2007-07-05 |
| NetBSD | Unknown | 2007-07-05 | 2007-07-05 |
| Nortel Networks, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Novell, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| OpenBSD | Unknown | 2007-07-05 | 2007-07-05 |
| Openwall GNU/*/Linux | Unknown | 2007-07-05 | 2007-07-05 |
| Proland Software, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| QNX, Software Systems, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Red Hat, Inc. | Not Vulnerable | 2007-07-05 | 2007-07-10 |
| Silicon Graphics, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Slackware Linux Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Snort | Not Vulnerable | 2007-07-05 | 2007-07-06 |
| Sony Corporation | Unknown | 2007-07-05 | 2007-07-05 |
| Sophos, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| Sourcefire | Unknown | 2007-07-05 | 2007-07-05 |
| Sun Microsystems, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| SUSE Linux | Unknown | 2007-07-05 | 2007-07-05 |
| Symantec, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
| The SCO Group | Unknown | 2007-07-05 | 2007-07-05 |
| TippingPoint, Technologies, Inc. | Not Vulnerable | 2007-07-05 | 2007-07-06 |
| Trend Micro | Unknown | 2007-07-05 | 2007-07-05 |
| Trustix Secure Linux | Unknown | 2007-07-05 | 2007-07-05 |
| Turbolinux | Unknown | 2007-07-05 | 2007-07-05 |
| Ubuntu | Unknown | 2007-07-05 | 2007-07-05 |
| Unisys | Unknown | 2007-07-05 | 2007-07-05 |
| Wind River Systems, Inc. | Unknown | 2007-07-05 | 2007-07-05 |
References
http://park8.wakwak.com/~app/Lhaca/
http://www.securityfocus.com/bid/24604
http://www.symantec.com/enterprise/security_response/weblog/2007/06/beware_of_lzh.html
http://vuln.sg/lhaca121-en.html
http://64.233.179.104/translate_c?hl=en&u=http://park8.wakwak.com/~app/Lhaca/overflow.html&prev=/search%3Fq%3Dlhaca%26hl%3Den%26client%3Dfirefox-a%26rls%3Dorg.mozilla:en-US:official%26hs%3DirC
http://en.wikipedia.org/wiki/LHA_(software)
http://secunia.com/advisories/25826/
http://oku.edu.mie-u.ac.jp/~okumura/compression/history.html
Credit
Thanks to Lhaca, Symantec, and Vuln.sg for information that was used in this report.
This document was written by Ryan Giobbi.
Other Information
| Date Public: | 2007-06-25 |
| Date First Published: | 2007-07-06 |
| Date Last Updated: | 2009-01-16 |
| CERT Advisory: | |
| CVE-ID(s): | CVE-2007-3375 |
| NVD-ID(s): | CVE-2007-3375 |
| US-CERT Technical Alerts: | |
| Metric: | 4.02 |
| Document Revision: | 8 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
|
Get Adobe Reader