Insufficient UI Warning of Dangerous Operations in UnZip - CVE-2005-0602

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU95179

Insufficient UI Warning of Dangerous Operations in UnZip - CVE-2005-0602

Published: August 2, 2024


Vulnerability identifier: #VU95179
CSH Severity: Low
CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2005-0602
CWE-ID: CWE-357
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to Unzip does not properly warn the user when extracting setuid or setgid files. A local user can trigger the vulnerability and escalate privileges on the system.


Affected software

UnZip
IBM Cloud Transformation Advisor
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data

How to mitigate CVE-2005-0602

Install updates from vendor's website.

UnZip - update to 5.52
IBM Cloud Transformation Advisor - update to 3.10.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.5

External References

Related Security Bulletins