Executive Summary
| Summary | |
|---|---|
| Title | gzip vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-116-1 | First vendor Publication | 2005-05-04 |
| Vendor | Ubuntu | Last vendor Modification | 2005-05-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: gzip The problem can be corrected by upgrading the affected package to version 1.3.5-9ubuntu3.1 (for Ubuntu 4.10), or 1.3.5-9ubuntu3.2 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Imran Ghory discovered a race condition in the file permission restore code of gzip and gunzip. While a user was compressing or decompressing a file, a local attacker with write permissions in the directory of that file could replace the target file with a hard link. This would cause gzip to restore the file permissions to the hard link target instead of to the gzip output file, which could be exploited to gain read or even write access to files of other users. (CAN-2005-0988) Ulf Harnhammar found a path traversal vulnerability when gunzip was used with the -N option. An attacker could exploit this to create files in an arbitrary directory with the permissions of a user if he tricked this user to decompress a specially crafted gzip file using the -N option (which can also happen in systems that automatically process uploaded gzip files). (CAN-2005-1228) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-116-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10242 | |||
| Oval ID: | oval:org.mitre.oval:def:10242 | ||
| Title: | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. | ||
| Description: | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0988 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11057 | |||
| Oval ID: | oval:org.mitre.oval:def:11057 | ||
| Title: | Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. | ||
| Description: | Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-1228 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1169 | |||
| Oval ID: | oval:org.mitre.oval:def:1169 | ||
| Title: | gzip Hard Link Attack | ||
| Description: | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0988 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | gzip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:170 | |||
| Oval ID: | oval:org.mitre.oval:def:170 | ||
| Title: | Sun Solaris Gzip Race condition and Directory Traversal Issues | ||
| Description: | Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-1228 | Version: | 3 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 | Product(s): | gzip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:382 | |||
| Oval ID: | oval:org.mitre.oval:def:382 | ||
| Title: | gzip Directory Traversal Vulnerability | ||
| Description: | Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-1228 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | gzip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:765 | |||
| Oval ID: | oval:org.mitre.oval:def:765 | ||
| Title: | GNU GZip CHMod File Permission Modification Race ConditionWeakness | ||
| Description: | Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0988 | Version: | 3 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 Sun Solaris 10 | Product(s): | gzip |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-06-03 | Name : Solaris Update for SunFreeware gzip 120719-02 File : nvt/gb_solaris_120719_02.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200505-05 (gzip) File : nvt/glsa_200505_05.nasl |
| 2008-09-04 | Name : FreeBSD Ports: gzip File : nvt/freebsd_gzip.nasl |
| 2008-09-04 | Name : FreeBSD Security Advisory (FreeBSD-SA-05:11.gzip.asc) File : nvt/freebsdsa_gzip.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 752-1 (gzip) File : nvt/deb_752_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-262-01 gzip File : nvt/esoft_slk_ssa_2006_262_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 15721 | gzip -N Option Traversal Arbitrary File Write gzip contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by a parsing flaw in the -N option of gzip that may allow an attacker to create an archive that writes to an arbitrary location on the system. This flaw may lead to a loss of integrity. |
| 15487 | gzip Race Condition Arbitrary File Permission Modification gzip contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered when an attacker has write access to a directory in which a targeted user is using gzip to decompress a file, and will gain the ability to modify the permissions on any file owned by the targeted user. This flaw may lead to a loss of integrity. |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2006-09-22 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-262-01.nasl - Type : ACT_GATHER_INFO |
| 2006-08-01 | Name : The remote operating system is missing a vendor-supplied patch. File : macosx_SecUpd2006-004.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2005-357.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-116-1.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_63bd4baddffe11d9b8750001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2005-07-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-752.nasl - Type : ACT_GATHER_INFO |
| 2005-06-13 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-357.nasl - Type : ACT_GATHER_INFO |
| 2005-05-19 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-092.nasl - Type : ACT_GATHER_INFO |
| 2005-05-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200505-05.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:58:44 |
|
