Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 157060

Summary:	CAN-2005-1260 - bzip2 decompression bomb vulnerability
Product:	[Retired] Fedora Legacy	Reporter:	Dominic Hargreaves <dom>
Component:	bzip2	Assignee:	Fedora Legacy Bugs <bugs>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	fc2	CC:	jkeating, marc.deslauriers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://scary.beasts.org/security/d5d5466da311d907/CESA-2005-002.txt
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-11-05 05:55:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	157057
Bug Blocks:

Description Dominic Hargreaves 2005-05-06 15:17:51 UTC

+++ This bug was initially created as a clone of Bug #157057 +++

Whilst playing with "random bitflipping" technology, an effective decompression
bomb attack against bzip2 was identified. bzip2 can be made to decompress
into a file indefinitely when it encounters a suitably corrupt bzip2 archive.

Demo bz2 archive:
http://scary.beasts.org/security/d5d5466da311d907/bomb.bz2

Fixed in 1.0.3.

No disclosure date yet.

Comment 1 David Eisenstein 2005-11-04 20:44:46 UTC

Removing security flag & This bug duplicates bug 158801.
Should be closed DUPLICATE.

Comment 2 Pekka Savola 2005-11-05 05:55:45 UTC


*** This bug has been marked as a duplicate of 158801 ***