National Cyber-Alert System

Vulnerability Summary for CVE-2008-4420

Overview

Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to CVE-2006-3985.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 19143

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/19143

External Source: HP

Name: SSRT080175

Type: Advisory; Patch Information

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011

External Source: VUPEN

Name: ADV-2009-0980

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2009/0980

External Source: VUPEN

Name: ADV-2006-2957

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2006/2957

External Source: SECTRACK

Name: 1022021

Hyperlink:http://www.securitytracker.com/id?1022021

External Source: BUGTRAQ

Name: 20060725 [vuln.sg] TurboZIP ZIP Repair Buffer Overflow Vulnerability

Hyperlink:http://www.securityfocus.com/archive/1/441084

External Source: BUGTRAQ

Name: 20060725 [vuln.sg] DynaZip DZIP32.DLL/DZIPS32.DLL Buffer Overflow Vulnerabilities

Hyperlink:http://www.securityfocus.com/archive/1/441083

External Source: MISC

Name: http://vuln.sg/turbozip6-en.html

Hyperlink:http://vuln.sg/turbozip6-en.html

External Source: MISC

Name: http://vuln.sg/dynazip5007-en.html

Hyperlink:http://vuln.sg/dynazip5007-en.html

External Source: SECUNIA

Name: 34659

Type: Advisory

Hyperlink:http://secunia.com/advisories/34659

External Source: SECUNIA

Name: 21180

Type: Advisory

Hyperlink:http://secunia.com/advisories/21180

External Source: OSVDB

Name: 53478

Hyperlink:http://osvdb.org/53478

External Source: HP

Name: SSRT080175

Type: Advisory

Hyperlink:http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011