OSVDB ID: 26908 Title: QuickZip Multiple Archive Traversal Arbitrary File Write |
Info |
|
|
Dates |
||||
|
|
Description |
QuickZip contains a flaw that allows a remote attacker to place malicious files to arbitrary locations outside of the specified directory. The issue is due to the program not properly sanitizing user input when extracting TAR, GZ and JAR archives, specifically directory traversal style attacks (../../). |
Classification |
Location:
Local Access Required,
Remote/Network Access Required
Attack Type: Input Manipulation Impact: Loss of Integrity Exploit: Exploit Available OSVDB: Web Related |
Solution |
Currently, there are no known upgrades or patches to correct this issue. It is possible to correct the flaw by implementing the following workarounds: do not extract untrusted archives, do not extract files as an administrative user. |
Products |
|
References |
|
Credit |
|