CVE-2006-1269: Buffer Overflow
First published: Sun Mar 19 2006(Updated: )
Buffer overflow in the parse function in parse.c in zoo 2.10 might allow local users to execute arbitrary code via long filename command line arguments, which are not properly handled during archive creation. NOTE: since this issue is local and not setuid, the set of attack scenarios is limited, although is reasonable to expect that there are some situations in which the zoo user might automatically list attacker-controlled filenames to add to the zoo archive.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoo Project Zoo | =2.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=183426
- http://www.gentoo.org/security/en/glsa/glsa-200603-12.xml
- http://secunia.com/advisories/19250
- http://www.securityfocus.com/bid/17126
- http://secunia.com/advisories/19254
- http://www.vupen.com/english/advisories/2006/0969
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25264
Frequently Asked Questions
What is the severity of CVE-2006-1269?
CVE-2006-1269 has a moderate severity level due to the potential for local users to execute arbitrary code.
How do I fix CVE-2006-1269?
To fix CVE-2006-1269, upgrade to Zoo version 2.10 or later, as this version addresses the buffer overflow vulnerability.
Who is affected by CVE-2006-1269?
CVE-2006-1269 affects local users of Zoo version 2.10 on systems where the software is installed.
What type of vulnerability is CVE-2006-1269?
CVE-2006-1269 is classified as a buffer overflow vulnerability that can be exploited through long filename command line arguments.
Can CVE-2006-1269 be exploited remotely?
No, CVE-2006-1269 is not exploitable remotely as it requires local access to the affected system.
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/description
- agent/author
- agent/references
- agent/event
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/rahul dhesi
- canonical/zoo project zoo
- version/zoo project zoo/2.10