CVE-2004-1094 (CNNVD-200501-184)

CRITICAL
中文标题:
InnerMedia DUNZIP32.dll 栈溢出漏洞
英文标题:
Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote at...
CVSS分数: 10.0
发布时间: 2004-12-01 05:00:00
漏洞类型: 授权问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

DUNZIP32.dll是一个较流行的压缩库。 InnerMedia DynaZip DUNZIP32.dll 5.00.03及之前版本中存在缓冲区溢出漏洞。 由于在解压包含有超长文件名的zip文件时存在溢出，攻击者可利用此漏洞执行任意代码。多个使用DUNZIP32.dll的软件均受此影响，包括Realplayer、RealOne、CheckMark Multiledger、McAfee及IBM Lotus Notes。

英文描述:

Buffer overflow in InnerMedia DynaZip DUNZIP32.dll file version 5.00.03 and earlier allows remote attackers to execute arbitrary code via a ZIP file containing a file with a long filename, as demonstrated using (1) a .rjs (skin) file in RealPlayer 10 through RealPlayer 10.5 (6.0.12.1053), RealOne Player 1 and 2, (2) the Restore Backup function in CheckMark Software Payroll 2004/2005 3.9.6 and earlier, (3) CheckMark MultiLedger before 7.0.2, (4) dtSearch 6.x and 7.x, (5) mcupdmgr.exe and mghtml.exe in McAfee VirusScan 10 Build 10.0.21 and earlier, (6) IBM Lotus Notes before 6.5.5, and other products. NOTE: it is unclear whether this is the same vulnerability as CVE-2004-0575, although the data manipulations are the same.

CWE类型:
（暂无数据）
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
checkmark checkmark_payroll * - - cpe:2.3:a:checkmark:checkmark_payroll:*:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.7.5 - - cpe:2.3:a:checkmark:checkmark_payroll:3.7.5:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.9.1 - - cpe:2.3:a:checkmark:checkmark_payroll:3.9.1:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.9.2 - - cpe:2.3:a:checkmark:checkmark_payroll:3.9.2:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.9.3 - - cpe:2.3:a:checkmark:checkmark_payroll:3.9.3:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.9.4 - - cpe:2.3:a:checkmark:checkmark_payroll:3.9.4:*:*:*:*:*:*:*
checkmark checkmark_payroll 3.9.5 - - cpe:2.3:a:checkmark:checkmark_payroll:3.9.5:*:*:*:*:*:*:*
checkmark multiledger * - - cpe:2.3:a:checkmark:multiledger:*:*:*:*:*:*:*:*
checkmark multiledger 6.0.3 - - cpe:2.3:a:checkmark:multiledger:6.0.3:*:*:*:*:*:*:*
checkmark multiledger 6.0.5 - - cpe:2.3:a:checkmark:multiledger:6.0.5:*:*:*:*:*:*:*
checkmark multiledger 7.0.0 - - cpe:2.3:a:checkmark:multiledger:7.0.0:*:*:*:*:*:*:*
innermedia dynazip_library 5.00.00 - - cpe:2.3:a:innermedia:dynazip_library:5.00.00:*:*:*:*:*:*:*
innermedia dynazip_library 5.00.01 - - cpe:2.3:a:innermedia:dynazip_library:5.00.01:*:*:*:*:*:*:*
innermedia dynazip_library 5.00.02 - - cpe:2.3:a:innermedia:dynazip_library:5.00.02:*:*:*:*:*:*:*
innermedia dynazip_library 5.00.03 - - cpe:2.3:a:innermedia:dynazip_library:5.00.03:*:*:*:*:*:*:*
realnetworks realone_player 1.0 - - cpe:2.3:a:realnetworks:realone_player:1.0:*:*:*:*:*:*:*
realnetworks realone_player 2.0 - - cpe:2.3:a:realnetworks:realone_player:2.0:*:*:*:*:*:*:*
realnetworks realplayer 10.0 - - cpe:2.3:a:realnetworks:realplayer:10.0:*:*:*:*:*:*:*
realnetworks realplayer 10.0_6.0.12.690 - - cpe:2.3:a:realnetworks:realplayer:10.0_6.0.12.690:*:*:*:*:*:*:*
realnetworks realplayer 10.0_beta - - cpe:2.3:a:realnetworks:realplayer:10.0_beta:*:*:*:*:*:*:*
realnetworks realplayer 10.5 - - cpe:2.3:a:realnetworks:realplayer:10.5:*:*:*:*:*:*:*
realnetworks realplayer 10.5_6.0.12.1016_beta - - cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1016_beta:*:*:*:*:*:*:*
realnetworks realplayer 10.5_6.0.12.1040 - - cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1040:*:*:*:*:*:*:*
realnetworks realplayer 10.5_6.0.12.1053 - - cpe:2.3:a:realnetworks:realplayer:10.5_6.0.12.1053:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
20051223 dtSearch DUNZIP32.dll Buffer Overflow Vulnerability mailing-list
cve.org
访问
1011944 vdb-entry
cve.org
访问
20041027 EEYE: RealPlayer Zipped Skin File Buffer Overflow mailing-list
cve.org
访问
payroll-dunzip32-bo(22737) vdb-entry
cve.org
访问
19906 vdb-entry
cve.org
访问
ADV-2005-2057 vdb-entry
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
20041027 High Risk Vulnerability in RealPlayer mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
19451 third-party-advisory
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
11555 vdb-entry
cve.org
访问
17394 third-party-advisory
cve.org
访问
realplayer-dunzip32-bo(17879) vdb-entry
cve.org
访问
20060330 McAfee VirusScan DUNZIP32.dll Buffer Overflow Vulnerability mailing-list
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
20060906 IBM Lotus Notes DUNZIP32.dll Buffer Overflow Vulnerability mailing-list
cve.org
访问
VU#582498 third-party-advisory
cve.org
访问
1012297 vdb-entry
cve.org
访问
ADV-2006-1176 vdb-entry
cve.org
访问
1016817 vdb-entry
cve.org
访问
18194 third-party-advisory
cve.org
访问
653 third-party-advisory
cve.org
访问
296 third-party-advisory
cve.org
访问
17096 third-party-advisory
cve.org
访问
无标题 x_refsource_CONFIRM
cve.org
访问
无标题 x_refsource_MISC
cve.org
访问
CVSS评分详情
10.0
CRITICAL
CVSS向量: AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS版本: 2.0
机密性
COMPLETE
完整性
COMPLETE
可用性
COMPLETE
时间信息
发布时间:
2004-12-01 05:00:00
修改时间:
2024-08-08 00:39:00
创建时间:
2025-11-11 15:32:22
更新时间:
2025-11-11 15:48:56
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2004-1094 2025-11-11 15:17:29 2025-11-11 07:32:22
NVD nvd_CVE-2004-1094 2025-11-11 14:50:56 2025-11-11 07:41:08
CNNVD cnnvd_CNNVD-200501-184 2025-11-11 15:08:44 2025-11-11 07:48:56
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:48:56
vulnerability_type: 未提取 → 授权问题; cnnvd_id: 未提取 → CNNVD-200501-184; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 授权问题
  • cnnvd_id: 未提取 -> CNNVD-200501-184
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:41:08
severity: SeverityLevel.MEDIUM → SeverityLevel.CRITICAL; cvss_score: 未提取 → 10.0; cvss_vector: NOT_EXTRACTED → AV:N/AC:L/Au:N/C:C/I:C/A:C; cvss_version: NOT_EXTRACTED → 2.0; affected_products_count: 0 → 24; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
  • cvss_score: 未提取 -> 10.0
  • cvss_vector: NOT_EXTRACTED -> AV:N/AC:L/Au:N/C:C/I:C/A:C
  • cvss_version: NOT_EXTRACTED -> 2.0
  • affected_products_count: 0 -> 24
  • data_sources: ['cve'] -> ['cve', 'nvd']