CVE-2010-2369: Lhasa Insecure Execution of .exe Files

Vulnerability ID: JVN#88850043 Summary: Lhasa may load executable files (.exe) in an insecure manner. Affected Products: - Lhasa ver0.19 and earlier versions Description: Lhasa is a file extraction utility supporting LZH and ZIP formats. When extracting files, Lhasa loads certain executable files (.exe), and there is an issue with the file search path, which may lead to executable files being loaded insecurely. Impact: Attackers can exploit this vulnerability to execute arbitrary code with the privileges of the running application. Solution: Update the software to the latest version, as per information provided by the developer. Vendor Status: - Yoshihito Takemura: Vulnerable - Last Updated: 2010/10/12 - Vendor Note: http://www.digitalpad.co.jp/~takechin/ References: IPA, Security Alert Regarding Vulnerability in Lhasa. JPCERT/CC Additional Information Vulnerability Analysis (Conducted by JPCERT/CC, Analyzed on 2010/10/12): - Access Required: Attack can be performed over the Internet using data packets; severity: high. - Authentication: Anonymous or no authentication required (IP address does not count); severity: high. - User Interaction Required: User must be persuaded to perform standard operations typically not considered harmful, such as clicking links or viewing files; severity: medium. - Exploit Complexity: User must be persuaded to perform difficult or suspicious actions; if legitimate users have elevated privileges, they may be more suspicious; severity: high. Acknowledgments: Makoto Shiotsuki reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. Additional Information: Includes JPCERT warnings, reports, advisories, etc. CVE: CVE-2010-2369 JVN iPed swoją: JVNDB-2010-000038 Update History: - 2010/10/15: English version released.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2010-2369: Lhasa Insecure Execution of .exe Files