Vulnerabilities > CVE-2004-0575 - Unspecified vulnerability in Microsoft Windows 2003 Server and Windows XP
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 4 |
Exploit-Db
description MS Windows Compressed Zipped Folders Exploit (MS04-034). CVE-2004-0575. Remote exploit for windows platform id EDB-ID:640 last seen 2016-01-31 modified 2004-11-19 published 2004-11-19 reporter tarako source https://www.exploit-db.com/download/640/ title Microsoft Windows - Compressed Zipped Folders Exploit MS04-034 description GetRight. CVE-2004-0575. Dos exploit for windows platform id EDB-ID:677 last seen 2016-01-31 modified 2004-12-06 published 2004-12-06 reporter ATmaCA source https://www.exploit-db.com/download/677/ title GetRight <= 5.2a - Skin File .grs Buffer Overflow Exploit
Nessus
| NASL family | Windows : Microsoft Bulletins |
| NASL id | SMB_NT_MS04-034.NASL |
| description | The remote version of Windows is vulnerable to a bug in the way it handles compressed (zipped) folders, that could in turn be exploited by an attacker to execute arbitrary code on the remote host. To exploit this flaw, an attacker would need to send a specially crafted .zip file to a victim on the remote host and wait for him to browse the file using the Windows Explorer. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 15459 |
| published | 2004-10-12 |
| reporter | This script is Copyright (C) 2004-2018 Tenable Network Security, Inc. |
| source | https://www.tenable.com/plugins/nessus/15459 |
| title | MS04-034: Vulnerability in zipped folders may allow code execution (873376) |
Oval
accepted 2011-10-24T04:00:04.404-04:00 class vulnerability contributors name David Proulx organization The MITRE Corporation name Jonathan Baker organization The MITRE Corporation name Matthew Wojcik organization The MITRE Corporation name Shane Shaffer organization G2, Inc. name Sudhir Gandhe organization Telos name Shane Shaffer organization G2, Inc. name Shane Shaffer organization G2, Inc.
description Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. family windows id oval:org.mitre.oval:def:1053 status accepted submitted 2004-10-14T12:00:00.000-04:00 title Windows XP (32-Bit) DUNZIP Integer Overflow version 74 accepted 2011-10-24T04:00:08.561-04:00 class vulnerability contributors name David Proulx organization The MITRE Corporation name Jonathan Baker organization The MITRE Corporation name Matthew Wojcik organization The MITRE Corporation name Shane Shaffer organization G2, Inc.
description Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. family windows id oval:org.mitre.oval:def:3913 status accepted submitted 2004-10-14T12:00:00.000-04:00 title Windows Server 2003 (32-Bit) DUNZIP Integer Overflow version 68 accepted 2011-10-24T04:00:09.580-04:00 class vulnerability contributors name David Proulx organization The MITRE Corporation name Jonathan Baker organization The MITRE Corporation name Matthew Wojcik organization The MITRE Corporation name Dragos Prisaca organization Gideon Technologies, Inc. name Shane Shaffer organization G2, Inc.
description Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. family windows id oval:org.mitre.oval:def:4276 status accepted submitted 2004-10-14T12:00:00.000-04:00 title Windows Server 2003 (64-Bit) DUNZIP Integer Overflow version 43 accepted 2011-10-24T04:00:25.999-04:00 class vulnerability contributors name David Proulx organization The MITRE Corporation name Jonathan Baker organization The MITRE Corporation name Matthew Wojcik organization The MITRE Corporation name Dragos Prisaca organization Gideon Technologies, Inc. name Shane Shaffer organization G2, Inc. name Sudhir Gandhe organization Telos name Shane Shaffer organization G2, Inc. name Shane Shaffer organization G2, Inc.
description Integer overflow in DUNZIP32.DLL for Microsoft Windows XP, Windows XP 64-bit Edition, Windows Server 2003, and Windows Server 2003 64-bit Edition allows remote attackers to execute arbitrary code via compressed (zipped) folders that involve an "unchecked buffer" and improper length validation. family windows id oval:org.mitre.oval:def:6397 status accepted submitted 2004-10-14T12:00:00.000-04:00 title Windows XP (64-Bit) DUNZIP Integer Overflow version 48
Saint
| bid | 11382 |
| description | Windows compressed folders buffer overflow |
| id | win_patch_zipfolder |
| osvdb | 10695 |
| title | windows_compressed_folders |
| type | client |
References
- http://marc.info/?l=ntbugtraq&m=109767342326300&w=2
- http://securitytracker.com/id?1011637
- http://www.ciac.org/ciac/bulletins/p-010.shtml
- http://www.eeye.com/html/research/advisories/AD20041012A.html
- http://www.kb.cert.org/vuls/id/649374
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-034
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17624
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17659
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1053
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3913
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4276
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6397