CVE-2010-0831: Path Traversal
Dan Rosenberg reported a directory traversal flaw in fastjar that allows an attacker, who is able to convince a victim to extract a malicious .jar file, to overwrite arbitrary files on disk without prompting the victim. The files to be overwritten must be writable by the user extracting the .jar file.
This issue has been assigned the name CVE-2010-0831, and it is possible that it is due to an incomplete fix for CVE-2006-3619 (bug #198912).
Upon investigation, the same problem exists in the jar archiver as provided by OpenJDK and java-1.4.2-gcj-compat.
Other sources
Directory traversal vulnerability in the extractjar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial pathname component in a filename within a .jar archive, a related issue to CVE-2005-1080. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-3619.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0831?
CVE-2010-0831 is rated as a moderate severity vulnerability due to the potential for arbitrary file creation or overwriting.
How do I fix CVE-2010-0831?
To resolve CVE-2010-0831, users should update to FastJar version 0.98 or apply patches provided by their distribution.
Which software versions are affected by CVE-2010-0831?
CVE-2010-0831 affects FastJar version 0.98 and Red Hat's gcc package versions up to 0:4.1.2-50.el5.
What type of attack can be performed using CVE-2010-0831?
An attacker can exploit CVE-2010-0831 through directory traversal to manipulate files on the server by crafting malicious .jar archives.
Is CVE-2010-0831 related to any other vulnerabilities?
Yes, CVE-2010-0831 is related to CVE-2005-1080, which also involves directory traversal issues.