Bug 156266 - CAN-2005-1228 directory traversal bug
Summary: CAN-2005-1228 directory traversal bug
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: gzip
Version: 4.0
Hardware: All
OS: Linux
medium
low
Target Milestone: ---
: ---
Assignee: Ivana Varekova
QA Contact: Ben Levenson
URL:
Whiteboard: impact=low,public=20050418,reported=2...
Keywords: Security
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-04-28 15:33 UTC by Josh Bressers
Modified: 2007-11-30 22:07 UTC (History)
0 users

(edit)
Clone Of:
(edit)
Last Closed: 2005-06-13 12:12:58 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:357 normal SHIPPED_LIVE Low: gzip security update 2005-06-13 04:00:00 UTC

Description Josh Bressers 2005-04-28 15:33:53 UTC
A directory traversal bug exists in multiple versions of gzip. When
compressing a file, gzip saves its original name but not its path inside
the compressed file. When using gunzip's "-N" option, the original name
found inside the compressed file will be used as the name to save the
decompressed file with. "gunzip -N" doesn't check if the original name inside
the compressed file has any "/" characters in it. This makes it possible to
create a malicious compressed file that when decompressed with "gunzip -N"
will create a file at an arbitrary location in the file system.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255

Comment 1 Josh Bressers 2005-04-28 15:42:30 UTC
This issue should also affect RHEL2.1 and RHEL3

Comment 2 Ivana Varekova 2005-05-03 09:47:30 UTC
The new versions (gzip-1.3.3-11.rhel3, gzip-1.3.3-15.rhel4, gzip-1.3-17.rhel2)
released.
Ivana Varekova

Comment 3 Josh Bressers 2005-06-13 12:12:58 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-357.html



Note You need to log in before you can comment on or make changes to this bug.