Executive Summary
| Summary | |
|---|---|
| Title | bzip2 security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2005:474 | First vendor Publication | 2005-06-16 |
| Vendor | RedHat | Last vendor Modification | 2005-06-16 |
| Severity (Vendor) | Low | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CAN-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CAN-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 155742 - CAN-2005-0953 bzip2 race condition 157548 - CAN-2005-1260 bzip2 decompression bomb (DoS) 159816 - CAN-2005-0758 bzgrep has security issue in sed usage |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2005-474.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-400 | Uncontrolled Resource Consumption ('Resource Exhaustion') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10700 | |||
| Oval ID: | oval:org.mitre.oval:def:10700 | ||
| Title: | bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb"). | ||
| Description: | bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb"). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-1260 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1081 | |||
| Oval ID: | oval:org.mitre.oval:def:1081 | ||
| Title: | gzip Argument Sanitation Vulnerability | ||
| Description: | zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0758 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | zgrep |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10902 | |||
| Oval ID: | oval:org.mitre.oval:def:10902 | ||
| Title: | Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. | ||
| Description: | Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0953 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1107 | |||
| Oval ID: | oval:org.mitre.oval:def:1107 | ||
| Title: | gzip zgrep Sanitation Vulnerability | ||
| Description: | zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0758 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | gzip |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1154 | |||
| Oval ID: | oval:org.mitre.oval:def:1154 | ||
| Title: | bzip2 Arbitrary File Permission Modification Vulnerability | ||
| Description: | Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0953 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | bzip2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:749 | |||
| Oval ID: | oval:org.mitre.oval:def:749 | ||
| Title: | bzip2 Decompression Bomb | ||
| Description: | bzip2 allows remote attackers to cause a denial of service (hard drive consumption) via a crafted bzip2 file that causes an infinite loop (a.k.a "decompression bomb"). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-1260 | Version: | 1 |
| Platform(s): | Red Hat Enterprise Linux 3 | Product(s): | bzip2 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9797 | |||
| Oval ID: | oval:org.mitre.oval:def:9797 | ||
| Title: | zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. | ||
| Description: | zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2005-0758 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-10-10 | Name : SLES9: Security update for bzip2 File : nvt/sles9p5010943.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200505-05 (gzip) File : nvt/glsa_200505_05.nasl |
| 2008-09-04 | Name : FreeBSD Ports: bzip2 File : nvt/freebsd_bzip2.nasl |
| 2008-09-04 | Name : FreeBSD Security Advisory (FreeBSD-SA-05:14.bzip2.asc) File : nvt/freebsdsa_bzip2.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 730-1 (bzip2) File : nvt/deb_730_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 741-1 (bzip2) File : nvt/deb_741_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2006-262-01 gzip File : nvt/esoft_slk_ssa_2006_262_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 16767 | bzip2 Malformed Archive Decompression DoS bzip2 contains a flaw that may allow a remote denial of service. The issue is triggered due to the handling of malformed bzip2 archives. It is possible for a remote attacker to send a malformed archive, which will cause the application to go into an infinite loop and consume a large amount of disk space and CPU resources, resulting in a loss of availability. |
| 16371 | zgrep Unspecified Arbitrary Command Execution |
| 15237 | bzip2 Race Condition Arbitrary File Permission Modification |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_10057.nasl - Type : ACT_GATHER_INFO |
| 2007-11-14 | Name : The remote host is missing a Mac OS X update which fixes a security issue. File : macosx_10_4_11.nasl - Type : ACT_GATHER_INFO |
| 2007-08-02 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-007.nasl - Type : ACT_GATHER_INFO |
| 2006-09-22 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2006-262-01.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2005-357.nasl - Type : ACT_GATHER_INFO |
| 2006-07-03 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2005-474.nasl - Type : ACT_GATHER_INFO |
| 2006-02-01 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2006-027.nasl - Type : ACT_GATHER_INFO |
| 2006-02-01 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-026.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-161-1.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-158-1.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-127-1.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_197f444fe8ef11d9b8750001020eed82.nasl - Type : ACT_GATHER_INFO |
| 2005-07-08 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-741.nasl - Type : ACT_GATHER_INFO |
| 2005-06-17 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-474.nasl - Type : ACT_GATHER_INFO |
| 2005-06-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-730.nasl - Type : ACT_GATHER_INFO |
| 2005-06-13 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2005-357.nasl - Type : ACT_GATHER_INFO |
| 2005-05-19 | Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2005-092.nasl - Type : ACT_GATHER_INFO |
| 2005-05-19 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-091.nasl - Type : ACT_GATHER_INFO |
| 2005-05-11 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200505-05.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:49:24 |
|
