OSVDB ID: 65467

Title: FastJar jartool.c extract_jar Function Traversal Arbitrary File Overwrite

Info

Disclosure

Jun 13, 2010

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Unknown

Description

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

Upgrade to version 0.98-3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Unknown or Incomplete

References

CVE ID: 2010-0831 (see also: NVD) 2010-2322 (see also: NVD)
Secunia Advisory ID: 40261 40468 42892 50786
Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2010-July/043729.html
http://packages.debian.org/changelogs/pool/main/f/fastjar/fastjar_0.98-3/changelog
http://www.gentoo.org/security/en/glsa/glsa-201209-21.xml
https://bugzilla.redhat.com/show_bug.cgi?id=594497
https://bugzilla.redhat.com/show_bug.cgi?id=601823
https://launchpad.net/bugs/540575
Mail List Post: http://marc.info/?l=oss-security&m=127602564508766&w=2
http://marc.info/?l=oss-security&m=127602564508766&w=2
http://marc.info/?l=oss-security&m=127602731712034&w=2
http://marc.info/?l=oss-security&m=127603032617644&w=2
Vendor Specific Advisory URL: https://lists.ubuntu.com/archives/ubuntu-security-announce/2010-June/001106.html
RedHat RHSA: https://rhn.redhat.com/errata/RHSA-2011-0025.html

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/65467