CVE-2004-0234: Buffer Overflow

Published May 5, 2004

Updated

Multiple stack-based buffer overflows in the getheader function in header.c for LHA 1.14, as used in products such as Barracuda Spam Firewall, allow remote attackers or local users to execute arbitrary code via long directory or file names in an LHA archive, which triggers the overflow when testing or extracting the archive.

Affected Software

50 affected components

Clearswift MAILsweeper=4.0

Clearswift MAILsweeper=4.1

Clearswift MAILsweeper=4.2

Clearswift MAILsweeper=4.3

Clearswift MAILsweeper=4.3.3

Clearswift MAILsweeper=4.3.4

Clearswift MAILsweeper=4.3.5

Clearswift MAILsweeper=4.3.6

Clearswift MAILsweeper=4.3.6_sp1

Clearswift MAILsweeper=4.3.7

Clearswift MAILsweeper=4.3.8

Clearswift MAILsweeper=4.3.10

Clearswift MAILsweeper=4.3.11

Clearswift MAILsweeper=4.3.13

F-Secure F-Secure anti-virus=4.51

F-Secure F-Secure anti-virus=4.52

F-Secure F-Secure anti-virus=4.60

F-Secure F-Secure anti-virus=5.5

F-Secure F-Secure anti-virus=5.41

F-Secure F-Secure anti-virus=5.42

F-Secure F-Secure anti-virus=5.52

F-Secure F-Secure anti-virus=6.21

F-Secure F-Secure anti-virus=2003

F-Secure F-Secure anti-virus=2004

F-Secure F-secure For Firewalls=6.20

F-Secure F-Secure Internet Security=2003

F-Secure F-Secure Internet Security=2004

F-Secure F-secure Personal Express=4.5

F-Secure F-secure Personal Express=4.6

F-Secure F-secure Personal Express=4.7

F-Secure Internet Gatekeeper=6.31

F-Secure Internet Gatekeeper=6.32

RARLAB WinRAR=3.20

redhat Lha=1.14i-9

SGI ProPack=2.4

SGI ProPack=3.0

Stalker Cgpmcafee=3.2

Tsugio Okamoto Lha=1.14

Tsugio Okamoto Lha=1.15

Tsugio Okamoto Lha=1.17

Winzip Winzip=9.0

redhat Fedora Core=core_1.0

Remediation

Patch Available

http://www.securityfocus.com/bid/10243

Event History

May 5, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-0234?

CVE-2004-0234 is considered to have a high severity as it may allow remote attackers to execute arbitrary code.

How do I fix CVE-2004-0234?

To fix CVE-2004-0234, it is recommended to update to the latest version of LHA or the affected software products.

Which products are affected by CVE-2004-0234?

CVE-2004-0234 affects multiple products including Clearswift MAILsweeper and various versions of F-Secure Antivirus.

What is the nature of the vulnerability in CVE-2004-0234?

The vulnerability in CVE-2004-0234 is due to multiple stack-based buffer overflows in the get_header function.

Can CVE-2004-0234 be exploited by local users?

Yes, CVE-2004-0234 can also be exploited by local users through long directory or file names in an LHA archive.