Vulnerabilities > CVE-2004-0970 - Unspecified vulnerability in GNU Gzip 1.2.4A

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
gnu
nessus
NVD
Published: 2005-02-09
Updated: 2024-11-20

Summary

The (1) gzexe, (2) zdiff, and (3) znew scripts in the gzip package, as used by other packages such as ncompress, allows local users to overwrite files via a symlink attack on temporary files. NOTE: the znew vulnerability may overlap CVE-2003-0367.

Vulnerable Configurations

Part Description Count
Application
Gnu
1

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-588.NASL
    descriptionTrustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack.
    last seen2020-06-01
    modified2020-06-02
    plugin id15686
    published2004-11-10
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15686
    titleDebian DSA-588-1 : gzip - insecure temporary files
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2004-142.NASL
    descriptionThe Trustix developers found some insecure temporary file creation problems in the zdiff, znew, and gzeze supplemental scripts in the gzip package. These flaws could allow local users to overwrite files via a symlink attack. A similar problem was fixed last year (CVE-2003-0367) in which this same problem was found in znew. At that time, Mandrakesoft also used mktemp to correct the problems in gzexe. This update uses mktemp to handle temporary files in the zdiff script.
    last seen2020-06-01
    modified2020-06-02
    plugin id15915
    published2004-12-07
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/15915
    titleMandrake Linux Security Advisory : gzip (MDKSA-2004:142)

References