CVE-2004-1094

Severity Score

10.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same.

Desbordamiento de búfer en el archivo InnerMedia DynaZip DUNZIP32.dll versión 5.00.03 y anteriores permite a atacantes ejecutar código de su elección mediante un fichero ZIP con un nombre de fichero largo, como se a demostrado usando (1) un fichero .rjs (piel) en RealPlayer 10 a 10.5 (6.0.12.1053) y RealOne Player 1 y 2, (2) la función función Restore Backup en CheckMark Software Payroll 2004/2005 3.9.6 y anteriores, (3) CheckMark MultiLedger anetrior a 7.0.2, (4) dtSearch 6.x y 7.x, (5) mcupdmgr.exe y mghtml.exe en McAfee VirusScan 10 construcción 10.0.21 y anteriores, y otros productos. NOTA: No está claro si esta es la misma vulnerabilidad que CVE-2004-0575, aunque la manipulación de datos es la misma.

*Credits: N/A

CVSS Scores

NISTv2 10.0

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2004-11-30 CVE Reserved
2004-12-01 CVE Published
2023-11-08 EPSS Updated
2024-08-08 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (28)

URL	Tag	Source
http://archives.neohapsis.com/archives/fulldisclosure/2004-10/1044.html	Mailing List
http://marc.info/?l=bugtraq&m=109894226007607&w=2	Mailing List
http://secunia.com/advisories/19451	Third Party Advisory
http://securityreason.com/securityalert/296	Third Party Advisory
http://securityreason.com/securityalert/653	Third Party Advisory
http://securitytracker.com/id?1011944	Vdb Entry
http://securitytracker.com/id?1012297	Vdb Entry
http://securitytracker.com/id?1016817	Vdb Entry
http://service.real.com/help/faq/security/041026_player/EN	X_refsource_confirm
http://www.kb.cert.org/vuls/id/582498	Third Party Advisory
http://www.networksecurity.fi/advisories/lotus-notes.html	X_refsource_misc
http://www.networksecurity.fi/advisories/mcafee-virusscan.html	X_refsource_misc
http://www.networksecurity.fi/advisories/multiledger.html	X_refsource_misc
http://www.networksecurity.fi/advisories/payroll.html	X_refsource_misc
http://www.osvdb.org/19906	Vdb Entry
http://www.securiteam.com/windowsntfocus/6Z00W00EAM.html	X_refsource_misc
http://www.securityfocus.com/archive/1/420274/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/429361/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/445369/100/0/threaded	Mailing List
http://www.vupen.com/english/advisories/2005/2057	Vdb Entry
http://www.vupen.com/english/advisories/2006/1176	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17879	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/22737	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/17096	2018-10-19
http://secunia.com/advisories/17394	2018-10-19
http://secunia.com/advisories/18194	2018-10-19
http://www.networksecurity.fi/advisories/dtsearch.html	2018-10-19
http://www.securityfocus.com/bid/11555	2018-10-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				<= 3.9.6 Search vendor "Checkmark" for product "Checkmark Payroll" and version " <= 3.9.6"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.7.5 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.7.5"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.9.1 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.9.1"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.9.2 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.9.2"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.9.3 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.9.3"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.9.4 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.9.4"		-		Affected
Checkmark Search vendor "Checkmark"		Checkmark Payroll Search vendor "Checkmark" for product "Checkmark Payroll"				3.9.5 Search vendor "Checkmark" for product "Checkmark Payroll" and version "3.9.5"		-		Affected
Checkmark Search vendor "Checkmark"		Multiledger Search vendor "Checkmark" for product "Multiledger"				<= 7.0.1 Search vendor "Checkmark" for product "Multiledger" and version " <= 7.0.1"		-		Affected
Checkmark Search vendor "Checkmark"		Multiledger Search vendor "Checkmark" for product "Multiledger"				6.0.3 Search vendor "Checkmark" for product "Multiledger" and version "6.0.3"		-		Affected
Checkmark Search vendor "Checkmark"		Multiledger Search vendor "Checkmark" for product "Multiledger"				6.0.5 Search vendor "Checkmark" for product "Multiledger" and version "6.0.5"		-		Affected
Checkmark Search vendor "Checkmark"		Multiledger Search vendor "Checkmark" for product "Multiledger"				7.0.0 Search vendor "Checkmark" for product "Multiledger" and version "7.0.0"		-		Affected
Innermedia Search vendor "Innermedia"		Dynazip Library Search vendor "Innermedia" for product "Dynazip Library"				5.00.00 Search vendor "Innermedia" for product "Dynazip Library" and version "5.00.00"		-		Affected
Innermedia Search vendor "Innermedia"		Dynazip Library Search vendor "Innermedia" for product "Dynazip Library"				5.00.01 Search vendor "Innermedia" for product "Dynazip Library" and version "5.00.01"		-		Affected
Innermedia Search vendor "Innermedia"		Dynazip Library Search vendor "Innermedia" for product "Dynazip Library"				5.00.02 Search vendor "Innermedia" for product "Dynazip Library" and version "5.00.02"		-		Affected
Innermedia Search vendor "Innermedia"		Dynazip Library Search vendor "Innermedia" for product "Dynazip Library"				5.00.03 Search vendor "Innermedia" for product "Dynazip Library" and version "5.00.03"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realone Player Search vendor "Realnetworks" for product "Realone Player"				1.0 Search vendor "Realnetworks" for product "Realone Player" and version "1.0"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realone Player Search vendor "Realnetworks" for product "Realone Player"				2.0 Search vendor "Realnetworks" for product "Realone Player" and version "2.0"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.0 Search vendor "Realnetworks" for product "Realplayer" and version "10.0"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.0_6.0.12.690 Search vendor "Realnetworks" for product "Realplayer" and version "10.0_6.0.12.690"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.0_beta Search vendor "Realnetworks" for product "Realplayer" and version "10.0_beta"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.5 Search vendor "Realnetworks" for product "Realplayer" and version "10.5"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.5_6.0.12.1016_beta Search vendor "Realnetworks" for product "Realplayer" and version "10.5_6.0.12.1016_beta"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.5_6.0.12.1040 Search vendor "Realnetworks" for product "Realplayer" and version "10.5_6.0.12.1040"		-		Affected
Realnetworks Search vendor "Realnetworks"		Realplayer Search vendor "Realnetworks" for product "Realplayer"				10.5_6.0.12.1053 Search vendor "Realnetworks" for product "Realplayer" and version "10.5_6.0.12.1053"		-		Affected