Vulnerability Details : CVE-2008-4420
Multiple stack-based buffer overflows in DZIP32.DLL before 5.0.0.8 in DynaZip Max and DZIPS32.DLL before 6.0.0.5 in DynaZip Max Secure; as used in HP OpenView Performance Agent C.04.60, HP Performance Agent C.04.70 and C.04.72, TurboZIP 6.0, and other products; allow user-assisted attackers to execute arbitrary code via a long filename in a ZIP archive during a (1) Fix (aka Repair), (2) Add, (3) Update, or (4) Freshen action, a related issue to CVE-2006-3985.
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2008-4420
Probability of exploitation activity in the next 30 days: 0.47%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 73 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-4420
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2008-4420
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-4420
- http://www.securityfocus.com/bid/19143
-
http://www.vupen.com/english/advisories/2006/2957
Vendor Advisory
-
http://vuln.sg/turbozip6-en.html
-
http://vuln.sg/dynazip5007-en.html
Exploit
-
http://www.vupen.com/english/advisories/2009/0980
Vendor Advisory
-
http://www.securitytracker.com/id?1022021
-
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01622011
Vendor Advisory
-
http://www.securityfocus.com/archive/1/441084
-
http://www.securityfocus.com/archive/1/441083
Products affected by CVE-2008-4420
- cpe:2.3:a:hp:openview_performance_agent:c.04.60:*:*:*:*:*:*:*
- cpe:2.3:a:hp:openview_performance_agent:c.04.70:*:*:*:*:*:*:*
- cpe:2.3:a:hp:openview_performance_agent:c.04.72:*:*:*:*:*:*:*
- cpe:2.3:a:innermedia:dynazip_max:*:*:*:*:*:*:*:*
- cpe:2.3:a:innermedia:dynazip_max_secure:*:*:*:*:*:*:*:*
- cpe:2.3:a:filestream:turbozip:6.0:*:*:*:*:*:*:*