Vulnerabilities > CVE-2005-0602 - Privilege Escalation vulnerability in Info-Zip Unzip 5.50

047910
CVSS 6.2 - MEDIUM
Attack vector
LOCAL
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
high complexity
info-zip
nessus

Summary

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.

Vulnerable Configurations

Part Description Count
Application
Info-Zip
2

Nessus

  • NASL familySolaris Local Security Checks
    NASL idSOLARIS9_112951.NASL
    descriptionSunOS 5.9: patchadd and patchrm Patch. Date this patch was last updated by Sun : Jul/02/10
    last seen2020-06-01
    modified2020-06-02
    plugin id29209
    published2007-12-04
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29209
    titleSolaris 9 (sparc) : 112951-15
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text in this plugin was
    # extracted from the Oracle SunOS Patch Updates.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(29209);
      script_version("1.14");
      script_cvs_date("Date: 2019/10/25 13:36:26");
    
      script_cve_id("CVE-2005-0602");
    
      script_name(english:"Solaris 9 (sparc) : 112951-15");
      script_summary(english:"Check for patch 112951-15");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote host is missing Sun Security Patch number 112951-15"
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "SunOS 5.9: patchadd and patchrm Patch.
    Date this patch was last updated by Sun : Jul/02/10"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://getupdates.oracle.com/readme/112951-15"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"You should install this patch for your system to be up-to-date."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/07/02");
      script_set_attribute(attribute:"plugin_publication_date", value:"2007/12/04");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2007-2019 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    if (solaris_check_patch(release:"5.9", arch:"sparc", patch:"112951-15", obsoleted_by:"", package:"SUNWswmt", version:"11.9,REV=2002.04.14.23.49") < 0) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:solaris_get_report());
      else security_warning(0);
      exit(0);
    }
    audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS8_108987.NASL
    descriptionSunOS 5.8: Patch for patchadd and patchrm. Date this patch was last updated by Sun : Nov/30/07
    last seen2020-06-01
    modified2020-06-02
    plugin id13307
    published2004-07-12
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13307
    titleSolaris 8 (sparc) : 108987-19
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text in this plugin was
    # extracted from the Oracle SunOS Patch Updates.
    #
    include("compat.inc");
    
    if (description)
    {
      script_id(13307);
      script_version("1.31");
      script_cvs_date("Date: 2019/10/25 13:36:24");
    
      script_cve_id("CVE-2005-0602");
    
      script_name(english:"Solaris 8 (sparc) : 108987-19");
      script_summary(english:"Check for patch 108987-19");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote host is missing Sun Security Patch number 108987-19"
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "SunOS 5.8: Patch for patchadd and patchrm.
    Date this patch was last updated by Sun : Nov/30/07"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://download.oracle.com/sunalerts/1000637.1.html"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"You should install this patch for your system to be up-to-date."
      );
      script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:sun:solaris");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2007/11/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2004/07/12");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc.");
      script_family(english:"Solaris Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Solaris/showrev");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("solaris.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108987-19", obsoleted_by:"", package:"SUNWadmr", version:"11.8,REV=1999.12.16.15.15") < 0) flag++;
    if (solaris_check_patch(release:"5.8", arch:"sparc", patch:"108987-19", obsoleted_by:"", package:"SUNWswmt", version:"11.8,REV=1999.12.16.15.15") < 0) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:solaris_get_report());
      else security_warning(0);
      exit(0);
    }
    audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS9_X86_114194.NASL
    descriptionSunOS 5.9_x86: patchadd and patchrm Patch. Date this patch was last updated by Sun : Jul/02/10
    last seen2020-06-01
    modified2020-06-02
    plugin id29211
    published2007-12-04
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29211
    titleSolaris 9 (x86) : 114194-12
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2005-197.NASL
    descriptionUnzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges. (CVE-2005-0602) Imran Ghory found a race condition in the handling of output files. While a file was unpacked by unzip, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the unzip user. This affects versions of unzip 5.52 and lower (CVE-2005-2475) The updated packages have been patched to address these issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id20125
    published2005-11-02
    reporterThis script is Copyright (C) 2005-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20125
    titleMandrake Linux Security Advisory : unzip (MDKSA-2005:197)
  • NASL familySolaris Local Security Checks
    NASL idSOLARIS8_X86_108988.NASL
    descriptionSunOS 5.8_x86: Patch for patchadd and patc. Date this patch was last updated by Sun : Nov/30/07
    last seen2020-06-01
    modified2020-06-02
    plugin id13417
    published2004-07-12
    reporterThis script is Copyright (C) 2004-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/13417
    titleSolaris 8 (x86) : 108988-19
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-159-1.NASL
    descriptionIf a ZIP archive contains binaries with the setuid and/or setgid bit set, unzip preserved those bits when extracting the archive. This could be exploited by tricking the administrator into unzipping an archive with a setuid-root binary into a directory the attacker can access. This allowed the attacker to execute arbitrary commands with root privileges. The updated version does not preserve setuid, setgid, and sticky bits any more by default. The old behaviour can be explicitly requested now by supplying the option
    last seen2020-06-01
    modified2020-06-02
    plugin id20563
    published2006-01-15
    reporterUbuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/20563
    titleUbuntu 4.10 / 5.04 : unzip vulnerability (USN-159-1)

Statements

contributorMark J Cox
lastmodified2006-08-30
organizationRed Hat
statementWe do not consider this a security vulnerability; this is the expected behaviour.