CVE-2005-1080: Path Traversal
A directory traversal flaw was found in the way the jar tool extracted JAR archive files. A specially crafted JAR archive could cause jar to overwrite arbitrary files writable by the user running jar when the archive was extracted.
Other sources
Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file.
— Red Hat
Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2, 1.5 allows remote attackers to write arbitrary files via a .. (dot dot) in filenames in a .jar file.
Initially the directory traversal flaw was reported for fastjar (see bug #594497) but was later found to also affect jar. The vulnerability in jar was reported in January 2005 but was never corrected upstream (CVE-2005-1080). Bug #594497 has a test script to determine if the vulnerability is present in jar as well as fastjar.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2005-1080?
CVE-2005-1080 is classified as a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2005-1080?
To fix CVE-2005-1080, update to the latest version of Java that resolves this vulnerability.
Which versions of the J2SE SDK are affected by CVE-2005-1080?
CVE-2005-1080 affects J2SE SDK versions 1.4.2 and 1.5.
Can CVE-2005-1080 allow unauthorized file access?
Yes, CVE-2005-1080 allows remote attackers to create or overwrite arbitrary files, leading to unauthorized access.
Is OpenJDK affected by CVE-2005-1080?
Yes, OpenJDK is also vulnerable to CVE-2005-1080, similar to affected versions of the J2SE SDK.