CVE-2001-1269
published 2001-07-12CVE-2001-1269: Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/'…
PriorityP411low2.1CVSS 2.0
AVLACLAuNCNIPAN
EPSS
0.50%
39.8th percentile
Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| info-zip | unzip | <= 5.42 | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
security flaw
vendor_redhat·2001-07-05·CVSS 2.1
CVE-2001-1269 [LOW] security flaw
security flaw
Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character.
GHSA
GHSA-mjxg-vj93-xfpq: Info-ZIP UnZip 5
ghsa_unreviewed·2022-04-30
CVE-2001-1269 [LOW] GHSA-mjxg-vj93-xfpq: Info-ZIP UnZip 5
Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character.
No detection rules found.
No public exploits indexed.
CWE
Absolute Path Traversal
mitre_cwe
CWE-36 Absolute Path Traversal
CWE-36: Absolute Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
This allows attackers to traverse the file system to access files or directories that are outside of the restricted directory.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands. The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Scope: Integrity. Impact: Modify Files or Directories. The attacker may be able to overwrite or create
CWE
Path Traversal: '/absolute/pathname/here'
mitre_cwe
CWE-37 Path Traversal: '/absolute/pathname/here'
CWE-37: Path Traversal: '/absolute/pathname/here'
The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate validation, which can allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality, Integrity. Impact: Read Files or Directories, Modify Files or Directories.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searchin
http://online.securityfocus.com/archive/1/196445http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1http://www.info-zip.org/pub/infozip/UnZip.htmlhttp://online.securityfocus.com/archive/1/196445http://sunsolve.sun.com/search/document.do?assetkey=1-26-47800-1http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000928.1-1http://www.info-zip.org/pub/infozip/UnZip.html
2001-07-12
Published