Mission and Overview
NVD is the U.S. government repository of standards based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g. FISMA).
Resource Status
NVD contains:
CVE Vulnerabilities
56363
Checklists
222
US-CERT Alerts
246
US-CERT Vuln Notes
2720
OVAL Queries
8140
CPE Names
73033

Last updated: Sun May 19 10:28:02 EDT 2013

CVE Publication rate: 11.33

Email List

NVD provides four mailing lists to the public. For information and subscription instructions please visit NVD Mailing Lists

Workload Index

Vulnerability Workload Index: 5.99

About Us
NVD is a product of the NIST Computer Security Division and is sponsored by the Department of Homeland Security's National Cyber Security Division. It supports the U.S. government multi-agency (OSD, DHS, NSA, DISA, and NIST) Information Security Automation Program. It is the U.S. government content repository for the Security Content Automation Protocol (SCAP).

National Cyber Awareness System

Vulnerability Summary for CVE-2005-2856

Original release date:09/08/2005
Last revised:07/28/2011
Source: US-CERT/NIST

Overview

Stack-based buffer overflow in the WinACE UNACEV2.DLL third-party compression utility before 2.6.0.0, as used in multiple products including (1) ALZip 5.51 through 6.11, (2) Servant Salamander 2.0 and 2.5 Beta 1, (3) WinHKI 1.66 and 1.67, (4) ExtractNow 3.x, (5) Total Commander 6.53, (6) Anti-Trojan 5.5.421, (7) PowerArchiver before 9.61, (8) UltimateZip 2.7,1, 3.0.3, and 3.1b, (9) Where Is It (WhereIsIt) 3.73.501, (10) FilZip 3.04, (11) IZArc 3.5 beta3, (12) Eazel 1.0, (13) Rising Antivirus 18.27.21 and earlier, (14) AutoMate 6.1.0.0, (15) BitZipper 4.1 SR-1, (16) ZipTV, and other products, allows user-assisted attackers to execute arbitrary code via a long filename in an ACE archive.

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type:Provides user account access, Allows partial confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: SECUNIA
Name: 16479
Type: Advisory; Patch Information
Hyperlink:http://secunia.com/advisories/16479
External Source: XF
Name: izarc-unacev2-bo(26480)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26480
External Source: XF
Name: eazel-ztvunacev2-bo(26479)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26479
External Source: XF
Name: filzip-unacev2-bo(26447)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26447
External Source: VUPEN
Name: ADV-2006-3495
Hyperlink:http://www.vupen.com/english/advisories/2006/3495
External Source: VUPEN
Name: ADV-2006-2824
Hyperlink:http://www.vupen.com/english/advisories/2006/2824
External Source: VUPEN
Name: ADV-2006-2184
Hyperlink:http://www.vupen.com/english/advisories/2006/2184
External Source: VUPEN
Name: ADV-2006-2047
Hyperlink:http://www.vupen.com/english/advisories/2006/2047
External Source: VUPEN
Name: ADV-2006-1836
Hyperlink:http://www.vupen.com/english/advisories/2006/1836
External Source: VUPEN
Name: ADV-2006-1835
Hyperlink:http://www.vupen.com/english/advisories/2006/1835
External Source: VUPEN
Name: ADV-2006-1797
Hyperlink:http://www.vupen.com/english/advisories/2006/1797
External Source: VUPEN
Name: ADV-2006-1775
Hyperlink:http://www.vupen.com/english/advisories/2006/1775
External Source: VUPEN
Name: ADV-2006-1725
Hyperlink:http://www.vupen.com/english/advisories/2006/1725
External Source: VUPEN
Name: ADV-2006-1694
Hyperlink:http://www.vupen.com/english/advisories/2006/1694
External Source: VUPEN
Name: ADV-2006-1681
Hyperlink:http://www.vupen.com/english/advisories/2006/1681
External Source: VUPEN
Name: ADV-2006-1611
Hyperlink:http://www.vupen.com/english/advisories/2006/1611
External Source: VUPEN
Name: ADV-2006-1577
Hyperlink:http://www.vupen.com/english/advisories/2006/1577
External Source: VUPEN
Name: ADV-2006-1565
Hyperlink:http://www.vupen.com/english/advisories/2006/1565
External Source: BID
Name: 14759
Hyperlink:http://www.securityfocus.com/bid/14759
External Source: BUGTRAQ
Name: 20060609 Secunia Research: AutoMate unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/436639/100/0/threaded
External Source: BUGTRAQ
Name: 20060517 Secunia Research: Eazel unacev2.dll Buffer Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/434279/100/0/threaded
External Source: BUGTRAQ
Name: 20060517 Secunia Research: IZArc unacev2.dll Buffer Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/434234/100/0/threaded
External Source: BUGTRAQ
Name: 20060515 Secunia Research: FilZip unacev2.dll Buffer Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/434011/100/0/threaded
External Source: BUGTRAQ
Name: 20060511 Secunia Research: UltimateZip unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/433693/100/0/threaded
External Source: BUGTRAQ
Name: 20060509 Secunia Research: Where Is It unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/433352/100/0/threaded
External Source: BUGTRAQ
Name: 20060508 Secunia Research: Anti-Trojan unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/433258/100/0/threaded
External Source: BUGTRAQ
Name: 20060501 Secunia Research: WinHKI unacev2.dll Buffer Overflow Vulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/432579/100/0/threaded
External Source: BUGTRAQ
Name: 20060428 Secunia Research: Servant Salamander unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/432357/100/0/threaded
External Source: OSVDB
Name: 25129
Hyperlink:http://www.osvdb.org/25129
External Source: SECTRACK
Name: 1016177
Hyperlink:http://securitytracker.com/id?1016177
External Source: SECTRACK
Name: 1016115
Hyperlink:http://securitytracker.com/id?1016115
External Source: SECTRACK
Name: 1016114
Hyperlink:http://securitytracker.com/id?1016114
External Source: SECTRACK
Name: 1016088
Hyperlink:http://securitytracker.com/id?1016088
External Source: SECTRACK
Name: 1016066
Hyperlink:http://securitytracker.com/id?1016066
External Source: SECTRACK
Name: 1016065
Hyperlink:http://securitytracker.com/id?1016065
External Source: SECTRACK
Name: 1016012
Hyperlink:http://securitytracker.com/id?1016012
External Source: SECTRACK
Name: 1016011
Hyperlink:http://securitytracker.com/id?1016011
External Source: SECTRACK
Name: 1015852
Hyperlink:http://securitytracker.com/id?1015852
External Source: SECTRACK
Name: 1014863
Hyperlink:http://securitytracker.com/id?1014863
External Source: MISC
Name: http://secunia.com/secunia_research/2006-38/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-38/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2006-36/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-36/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2006-33/advisory/
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-33/advisory/
External Source: MISC
Name: http://secunia.com/secunia_research/2006-32/advisory/
Hyperlink:http://secunia.com/secunia_research/2006-32/advisory/
External Source: MISC
Name: http://secunia.com/secunia_research/2006-30/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-30/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2006-29/advisory/
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-29/advisory/
External Source: MISC
Name: http://secunia.com/secunia_research/2006-28/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-28/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2006-27/
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-27/
External Source: MISC
Name: http://secunia.com/secunia_research/2006-25/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-25/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2006-24/advisory
Type: Advisory
Hyperlink:http://secunia.com/secunia_research/2006-24/advisory
External Source: MISC
Name: http://secunia.com/secunia_research/2005-41/advisory/
Hyperlink:http://secunia.com/secunia_research/2005-41/advisory/
External Source: SECUNIA
Name: 20009
Type: Advisory
Hyperlink:http://secunia.com/advisories/20009
External Source: SECUNIA
Name: 19977
Type: Advisory
Hyperlink:http://secunia.com/advisories/19977
External Source: SECUNIA
Name: 19975
Type: Advisory
Hyperlink:http://secunia.com/advisories/19975
External Source: SECUNIA
Name: 19967
Type: Advisory
Hyperlink:http://secunia.com/advisories/19967
External Source: SECUNIA
Name: 19938
Type: Advisory
Hyperlink:http://secunia.com/advisories/19938
External Source: SECUNIA
Name: 19931
Hyperlink:http://secunia.com/advisories/19931
External Source: SECUNIA
Name: 19890
Type: Advisory
Hyperlink:http://secunia.com/advisories/19890
External Source: SECUNIA
Name: 19834
Type: Advisory
Hyperlink:http://secunia.com/advisories/19834
External Source: SECUNIA
Name: 19612
Hyperlink:http://secunia.com/advisories/19612
External Source: SECUNIA
Name: 19596
Hyperlink:http://secunia.com/advisories/19596
External Source: SECUNIA
Name: 19581
Type: Advisory
Hyperlink:http://secunia.com/advisories/19581
External Source: SECUNIA
Name: 19458
Type: Advisory
Hyperlink:http://secunia.com/advisories/19458
External Source: SECUNIA
Name: 19454
Type: Advisory
Hyperlink:http://secunia.com/advisories/19454
External Source: BUGTRAQ
Name: 20050908 Secunia Research: ALZip ACE Archive Handling Buffer Overflow
Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=112621008228458&w=2
External Source: XF
Name: bitzipper-unacev2-bo(27763)
Hyperlink:http://xforce.iss.net/xforce/xfdb/27763
External Source: XF
Name: automate-unacev2-bo(26982)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26982
External Source: XF
Name: risingantivirus-unacev2-bo(26736)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26736
External Source: XF
Name: ultimatezip-unacev2-bo(26385)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26385
External Source: XF
Name: whereisit-unacev2-bo(26315)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26315
External Source: XF
Name: antitrojan-unacev2-bo(26302)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26302
External Source: XF
Name: powerarchiver-unacev2-ace-bo(26272)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26272
External Source: XF
Name: extractnow-unacev2-ace-bo(26168)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26168
External Source: XF
Name: winhki-unacev2-bo(26142)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26142
External Source: XF
Name: servant-salamander-unacev2-bo(26116)
Hyperlink:http://xforce.iss.net/xforce/xfdb/26116
External Source: BID
Name: 19884
Hyperlink:http://www.securityfocus.com/bid/19884
External Source: BUGTRAQ
Name: 20060717 Secunia Research: BitZipper unacev2.dll Buffer OverflowVulnerability
Hyperlink:http://www.securityfocus.com/archive/1/archive/1/440303/100/0/threaded
External Source: SECTRACK
Name: 1016512
Hyperlink:http://securitytracker.com/id?1016512
External Source: SECTRACK
Name: 1016257
Hyperlink:http://securitytracker.com/id?1016257
External Source: SREASON
Name: 49
Hyperlink:http://securityreason.com/securityalert/49
External Source: MISC
Name: http://secunia.com/secunia_research/2006-50/advisory/
Hyperlink:http://secunia.com/secunia_research/2006-50/advisory/
External Source: MISC
Name: http://secunia.com/secunia_research/2006-46/advisory/
Hyperlink:http://secunia.com/secunia_research/2006-46/advisory/
External Source: SECUNIA
Name: 20270
Hyperlink:http://secunia.com/advisories/20270
External Source: SECUNIA
Name: 19939
Hyperlink:http://secunia.com/advisories/19939

Vulnerable software and versions

Nav control imageConfiguration 1
spacerNav control imageOR
spacerspacerNav control image* cpe:/a:winace:winace:2.6.0.0
* Denotes Vulnerable Software
* Changes related to vulnerability configurations

Technical Details

Vulnerability Type (View All)
CVE Standard Vulnerability Entry:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2856