Vulnerability Description
Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to CVE-2006-3985.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows | All versions |
| Hp | Openview Performance Agent | c.04.60 |
| Innermedia | Dynazip Max | <= 5.0.0.7 |
| Innermedia | Dynazip Max Secure | <= 6.0.0.4 |
| Filestream | Turbozip | 6.0 |
Related Weaknesses (CWE)
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011Vendor Advisory
- http://innermedia.com/upgrades.html
- http://osvdb.org/53478
- http://secunia.com/advisories/21180Vendor Advisory
- http://secunia.com/advisories/34659Vendor Advisory
- http://vuln.sg/dynazip5007-en.htmlExploit
- http://vuln.sg/turbozip6-en.html
- http://www.securityfocus.com/archive/1/441083
- http://www.securityfocus.com/archive/1/441084
- http://www.securityfocus.com/bid/19143Patch
- http://www.securitytracker.com/id?1022021
- http://www.vupen.com/english/advisories/2006/2957Vendor Advisory
- http://www.vupen.com/english/advisories/2009/0980Vendor Advisory
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011Vendor Advisory
- http://innermedia.com/upgrades.html
FAQ
What is CVE-2008-4420?
CVE-2008-4420 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance...
How severe is CVE-2008-4420?
CVE-2008-4420 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4420?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Windows, Hp Openview Performance Agent, Innermedia Dynazip Max, Innermedia Dynazip Max Secure, Filestream Turbozip.