Fedora Legacy Test Update Notification: lha

[Marc Deslauriers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ---------------------------------------------------------------------
Fedora Legacy Test Update Notification
FEDORALEGACY-2004-1833
Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=1833
2004-09-30
- ---------------------------------------------------------------------

Name        : lha
Versions    : 7.3: 1.14i-4.7.3.3.legacy, 9: 1.14i-9.3.legacy
Summary     : An archiving and compression utility for LHarc format
archives.
Description : 
LHA is an archiving and compression utility for LHarc format archives.
LHA is mostly used in the DOS world, but can be used under Linux to
extract DOS files from LHA archives.
 
Install the lha package if you need to extract DOS files from LHA
archives.

- ---------------------------------------------------------------------
Update Information:

Ulf Harnhammar discovered two stack buffer overflows and two directory
traversal flaws in LHA. An attacker could exploit the buffer overflows
by
creating a carefully crafted LHA archive in such a way that arbitrary
code
would be executed when the archive is tested or extracted by a victim.
The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0234 to this issue. An attacker could exploit
the directory traversal issues to create files as the victim outside of
the
expected directory. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0235 to this issue.

Lukasz Wojtow discovered a stack-based buffer overflow in all versions
of lha up to and including version 1.14. A carefully created archive
could
allow an attacker to execute arbitrary code when a victim extracts or
tests
the archive. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0769 to this issue.

Buffer overflows were discovered in the command line processing of all
versions of lha up to and including version 1.14. If a malicious user
could trick a victim into passing a specially crafted command line to
the
lha command, it is possible that arbitrary code could be executed. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned
the names CAN-2004-0771 and CAN-2004-0694 to these issues.

Thomas Biege discovered a shell meta character command execution
vulnerability in all versions of lha up to and including 1.14. An
attacker
could create a directory with shell meta characters in its name which
could
lead to arbitrary command execution. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0745 to
this issue.

- ---------------------------------------------------------------------
7.3 changelog:
* Wed Sep 08 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
1.14i-4.7.3.3.legacy
 
- - Rebuilt as Fedora Legacy security update
 
* Tue Aug 03 2004 Than Ngo <than at redhat.com> 1.14i-10.4
 
- - another LHA buffer overflow
 
* Fri Jun 25 2004 Than Ngo <than at redhat.com> 1.14i-10.3
 
- - fix LHA buffer overflow

9 changelog:
* Wed Sep 08 2004 Marc Deslauriers <marcdeslauriers at videotron.ca>
1.14i-9.3.legacy
 
- - Rebuilt as Fedora Legacy security update
 
* Tue Aug 03 2004 Than Ngo <than at redhat.com> 1.14i-10.4
 
- - another LHA buffer overflow
 
* Fri Jun 25 2004 Than Ngo <than at redhat.com> 1.14i-10.3
 
- - fix LHA buffer overflow

- ---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedoralegacy.org/redhat/
(sha1sums)

421a0998d84a2b75ebaa0bb334273ce1dad2be88
7.3/updates-testing/i386/lha-1.14i-4.7.3.3.legacy.i386.rpm
aa6033fd436ea908b38b2035f096223f92ed780d
7.3/updates-testing/SRPMS/lha-1.14i-4.7.3.3.legacy.src.rpm
344f153d52712fbcba78e79b28fe46012d826a74
9/updates-testing/i386/lha-1.14i-9.3.legacy.i386.rpm
ba93abb5201ef503bb866403dae811eb5caa3a86
9/updates-testing/SRPMS/lha-1.14i-9.3.legacy.src.rpm

- ---------------------------------------------------------------------

Please test and comment in bugzilla.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBW98ZLMAs/0C4zNoRApynAKCUz+Rw0vg3eBsNzXNMoVaH509TXgCfdrNN
W/zhlFT7dbclDUwdfgsBKic=
=Lgps
-----END PGP SIGNATURE-----