NVD Vulnerability Detail

CVE-2013-4668

Summary	Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.
Publication Date	July 19, 2013, 1:51 a.m.
Registration Date	Jan. 26, 2021, 3:43 p.m.
Last Update	Nov. 21, 2024, 10:56 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:file_roller_project:file_roller::::::gnome::*	3.9.1			3.9.3
cpe:2.3:a:file_roller_project:file_roller::::::gnome::*	3.8.0			3.8.3
cpe:2.3:a:file_roller_project:file_roller::::::gnome::*	3.6.0			3.6.4

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.html	Broken Link
2	http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.html	Broken Link
3	http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.html	Broken Link
4	http://lists.opensuse.org/opensuse-updates/2013-07/msg00095.html	Broken Link
5	http://secunia.com/advisories/54351	Not Applicable Third Party Advisory
6	http://secunia.com/advisories/54351	Not Applicable Third Party Advisory
7	http://www.ocert.org/advisories/ocert-2013-001.html	Third Party Advisory
8	http://www.ocert.org/advisories/ocert-2013-001.html	Third Party Advisory
9	http://www.securityfocus.com/bid/61008	Third Party Advisory VDB Entry
10	http://www.securityfocus.com/bid/61008	Third Party Advisory VDB Entry
11	http://www.ubuntu.com/usn/USN-1906-1	Third Party Advisory
12	http://www.ubuntu.com/usn/USN-1906-1	Third Party Advisory
13	https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631	Patch Third Party Advisory
14	https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

File Roller におけるディレクトリトラバーサルの脆弱性

Title	File Roller におけるディレクトリトラバーサルの脆弱性
Summary	File Roller には、libarchive を使用時に、ディレクトリトラバーサルの脆弱性が存在します。本件は、fr-archive-libarchive.c および fr-window.c に関する脆弱性です。
Possible impacts	第三者により、"ディレクトリ構造保持 (Keep directory structure)" アクションを適切に処理しない巧妙に細工されたアーカイブを介して、任意のファイルを作成される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 27, 2013, midnight
Registration Date	July 22, 2013, 4:27 p.m.
Last Update	Aug. 27, 2013, 6:17 p.m.

Affected System

Paolo Bacchilega

File Roller 3.6.4 未満の 3.6.x

File Roller 3.8.3 未満の 3.8.x

File Roller 3.9.3 未満の 3.9.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4668	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4668
National Vulnerability Database (NVD)
2	CVE-2013-4668	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4668

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
Paolo Bacchilega
1	Top Page	http://fileroller.sourceforge.net/
Ubuntu Security Notice
2	USN-1906-1	http://www.ubuntu.com/usn/USN-1906-1

その他

No	Name	URL
関連文書
1	#2013-001 File Roller path sanitization errors	http://www.ocert.org/advisories/ocert-2013-001.html
2	CERT-2013-001	http://archives.neohapsis.com/archives/bugtraq/2013-07/0039.html
3	file-roller	https://git.gnome.org/browse/file-roller/commit/?id=b147281293a8307808475e102a14857055f81631

Change Log

No	Changed Details	Date of change
0	[2013年07月22日] 掲載 [2013年08月27日] ベンダ情報：Ubuntu (USN-1906-1) を追加	Feb. 17, 2018, 10:37 a.m.