CVE-2004-0916 - Vulnerability Details - OpenCVE

Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cabextract Project	Cabextract

Configuration 1 [-]

OR	cpe:2.3:a:cabextract_project:cabextract:0.2:::::::*
	cpe:2.3:a:cabextract_project:cabextract:0.6:::::::*
	cpe:2.3:a:cabextract_project:cabextract:1.0:::::::*

No data.

References

Link	Providers
http://secunia.com/advisories/12882/
http://www.debian.org/security/2004/dsa-574
http://www.kyz.uklinux.net/cabextract.php#changes
http://www.securityfocus.com/bid/11460
https://exchange.xforce.ibmcloud.com/vulnerabilities/17766

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2004-11-19T05:00:00

Updated: 2024-08-08T00:31:47.982Z

Reserved: 2004-09-27T00:00:00

Link: CVE-2004-0916

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2005-01-27T05:00:00.000

Modified: 2025-04-03T01:03:51.193

Link: CVE-2004-0916

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2004-10-28T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-10T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.kyz.uklinux.net/cabextract.php#changes"}, {"name": "12882", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/12882/"}, {"name": "DSA-574", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2004/dsa-574"}, {"name": "cabextract-directory-traversal(17766)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17766"}, {"name": "11460", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/11460"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2004-0916", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.kyz.uklinux.net/cabextract.php#changes", "refsource": "CONFIRM", "url": "http://www.kyz.uklinux.net/cabextract.php#changes"}, {"name": "12882", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/12882/"}, {"name": "DSA-574", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2004/dsa-574"}, {"name": "cabextract-directory-traversal(17766)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17766"}, {"name": "11460", "refsource": "BID", "url": "http://www.securityfocus.com/bid/11460"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-08T00:31:47.982Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.kyz.uklinux.net/cabextract.php#changes"}, {"name": "12882", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/12882/"}, {"name": "DSA-574", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2004/dsa-574"}, {"name": "cabextract-directory-traversal(17766)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17766"}, {"name": "11460", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/11460"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2004-0916", "datePublished": "2004-11-19T05:00:00", "dateReserved": "2004-09-27T00:00:00", "dateUpdated": "2024-08-08T00:31:47.982Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cabextract_project:cabextract:0.2:*:*:*:*:*:*:*", "matchCriteriaId": "924128C3-DE58-4B6A-A497-59B5D3D311DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:cabextract_project:cabextract:0.6:*:*:*:*:*:*:*", "matchCriteriaId": "8D5EC4F7-C88D-4DBA-A371-58DF4E6344A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:cabextract_project:cabextract:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "670769A1-4133-4834-94E0-BF5F3EF2FFF5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in cabextract before 1.1 allows remote attackers to overwrite arbitrary files via a cabinet file containing .. (dot dot) sequences in a filename."}], "id": "CVE-2004-0916", "lastModified": "2025-04-03T01:03:51.193", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2005-01-27T05:00:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/12882/"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2004/dsa-574"}, {"source": "cve@mitre.org", "url": "http://www.kyz.uklinux.net/cabextract.php#changes"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://www.securityfocus.com/bid/11460"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17766"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/12882/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://www.debian.org/security/2004/dsa-574"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.kyz.uklinux.net/cabextract.php#changes"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.securityfocus.com/bid/11460"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17766"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}