Red Hat Bugzilla – Bug 155742
CAN-2005-0953 bzip2 race condition
Last modified: 2007-11-30 17:07:17 EST
Race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete.
This issue should also affect RHEL3 and RHEL2.1
Created attachment 113842 [details]
Proposed patch from Steve Grubb
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.