Bug 156266

Summary:	CAN-2005-1228 directory traversal bug
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	gzip	Assignee:	Ivana Varekova <varekova>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	low	Docs Contact:
Priority:	medium
Version:	4.0	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=low,public=20050418,reported=20050422,source=cve
Fixed In Version:	RHSA-2005-357	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-06-13 12:12:58 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2005-04-28 15:33:53 UTC

A directory traversal bug exists in multiple versions of gzip. When
compressing a file, gzip saves its original name but not its path inside
the compressed file. When using gunzip's "-N" option, the original name
found inside the compressed file will be used as the name to save the
decompressed file with. "gunzip -N" doesn't check if the original name inside
the compressed file has any "/" characters in it. This makes it possible to
create a malicious compressed file that when decompressed with "gunzip -N"
will create a file at an arbitrary location in the file system.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255

Comment 1 Josh Bressers 2005-04-28 15:42:30 UTC

This issue should also affect RHEL2.1 and RHEL3

Comment 2 Ivana Varekova 2005-05-03 09:47:30 UTC

The new versions (gzip-1.3.3-11.rhel3, gzip-1.3.3-15.rhel4, gzip-1.3-17.rhel2)
released.
Ivana Varekova

Comment 3 Josh Bressers 2005-06-13 12:12:58 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-357.html