Vulnerabilities > CVE-2005-0758
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 | |
| OS | 2 |
Nessus
NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2006-026.NASL description A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep. As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched. The updated packages have been patched to correct these problems. last seen 2020-06-01 modified 2020-06-02 plugin id 20831 published 2006-02-01 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20831 title Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Mandrake Linux Security Advisory MDKSA-2006:026. # The text itself is copyright (C) Mandriva S.A. # include("compat.inc"); if (description) { script_id(20831); script_version ("1.13"); script_cvs_date("Date: 2019/08/02 13:32:48"); script_cve_id("CVE-2005-0758", "CVE-2005-0953"); script_xref(name:"MDKSA", value:"2006:026"); script_name(english:"Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value: "The remote Mandrake Linux host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep. As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched. The updated packages have been patched to correct these problems." ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:bzip2"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64bzip2_1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64bzip2_1-devel"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libbzip2_1"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libbzip2_1-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandrakesoft:mandrake_linux:10.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2006"); script_set_attribute(attribute:"cpe", value:"x-cpe:/o:mandrakesoft:mandrake_linux:le2005"); script_set_attribute(attribute:"patch_publication_date", value:"2006/01/30"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/02/01"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 Tenable Network Security, Inc."); script_family(english:"Mandriva Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux"); if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu); flag = 0; if (rpm_check(release:"MDK10.1", reference:"bzip2-1.0.2-20.4.101mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64bzip2_1-1.0.2-20.4.101mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.1", cpu:"x86_64", reference:"lib64bzip2_1-devel-1.0.2-20.4.101mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libbzip2_1-1.0.2-20.4.101mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.1", cpu:"i386", reference:"libbzip2_1-devel-1.0.2-20.4.101mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.2", reference:"bzip2-1.0.2-20.3.102mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64bzip2_1-1.0.2-20.3.102mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.2", cpu:"x86_64", reference:"lib64bzip2_1-devel-1.0.2-20.3.102mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libbzip2_1-1.0.2-20.3.102mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK10.2", cpu:"i386", reference:"libbzip2_1-devel-1.0.2-20.3.102mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK2006.0", reference:"bzip2-1.0.3-1.2.20060mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK2006.0", cpu:"x86_64", reference:"lib64bzip2_1-1.0.3-1.2.20060mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK2006.0", cpu:"x86_64", reference:"lib64bzip2_1-devel-1.0.3-1.2.20060mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK2006.0", cpu:"i386", reference:"libbzip2_1-1.0.3-1.2.20060mdk", yank:"mdk")) flag++; if (rpm_check(release:"MDK2006.0", cpu:"i386", reference:"libbzip2_1-devel-1.0.3-1.2.20060mdk", yank:"mdk")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2006-262-01.NASL description New gzip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix possible security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 22421 published 2006-09-22 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/22421 title Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : gzip (SSA:2006-262-01) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Slackware Security Advisory 2006-262-01. The text # itself is copyright (C) Slackware Linux, Inc. # include("compat.inc"); if (description) { script_id(22421); script_version("1.16"); script_cvs_date("Date: 2019/10/25 13:36:20"); script_cve_id("CVE-2005-0758", "CVE-2005-0988", "CVE-2005-1228", "CVE-2006-4334", "CVE-2006-4335", "CVE-2006-4336", "CVE-2006-4337", "CVE-2006-4338"); script_xref(name:"SSA", value:"2006-262-01"); script_name(english:"Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : gzip (SSA:2006-262-01)"); script_summary(english:"Checks for updated package in /var/log/packages"); script_set_attribute( attribute:"synopsis", value:"The remote Slackware host is missing a security update." ); script_set_attribute( attribute:"description", value: "New gzip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix possible security issues." ); # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?366c264f" ); script_set_attribute(attribute:"solution", value:"Update the affected gzip package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:gzip"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:10.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:8.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:9.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:9.1"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/05/02"); script_set_attribute(attribute:"patch_publication_date", value:"2006/09/19"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/09/22"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Slackware Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("slackware.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware"); if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu); flag = 0; if (slackware_check(osver:"8.1", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i386", pkgnum:"1_slack8.1")) flag++; if (slackware_check(osver:"9.0", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i386", pkgnum:"1_slack9.0")) flag++; if (slackware_check(osver:"9.1", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i486", pkgnum:"1_slack9.1")) flag++; if (slackware_check(osver:"10.0", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i486", pkgnum:"1_slack10.0")) flag++; if (slackware_check(osver:"10.1", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i486", pkgnum:"1_slack10.1")) flag++; if (slackware_check(osver:"10.2", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i486", pkgnum:"1_slack10.2")) flag++; if (slackware_check(osver:"current", pkgname:"gzip", pkgver:"1.3.5", pkgarch:"i486", pkgnum:"1")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get()); else security_hole(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-158-1.NASL description zgrep did not handle shell metacharacters like last seen 2020-06-01 modified 2020-06-02 plugin id 20562 published 2006-01-15 reporter Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20562 title Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-158-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(20562); script_version("1.14"); script_cvs_date("Date: 2019/08/02 13:33:00"); script_cve_id("CVE-2005-0758"); script_xref(name:"USN", value:"158-1"); script_name(english:"Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1)"); script_summary(english:"Checks dpkg output for updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Ubuntu host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute(attribute:"solution", value:"Update the affected gzip package."); script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:gzip"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:4.10"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:5.04"); script_set_attribute(attribute:"patch_publication_date", value:"2005/08/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2006/01/15"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! ereg(pattern:"^(4\.10|5\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 4.10 / 5.04", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"4.10", pkgname:"gzip", pkgver:"1.3.5-9ubuntu3.3")) flag++; if (ubuntu_check(osver:"5.04", pkgname:"gzip", pkgver:"1.3.5-9ubuntu3.4")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "gzip"); }NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-357.NASL description An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim. gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0988 to this issue. A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1228 to this issue. Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 18469 published 2005-06-13 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18469 title RHEL 2.1 / 3 / 4 : gzip (RHSA-2005:357) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-161-1.NASL description USN-158-1 fixed a command injection vulnerability in the last seen 2020-06-01 modified 2020-06-02 plugin id 20567 published 2006-01-15 reporter Ubuntu Security Notice (C) 2005-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20567 title Ubuntu 4.10 / 5.04 : bzip2 vulnerability (USN-161-1) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2006-027.NASL description Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. This was previously corrected in MDKSA-2005:092, however the fix was incomplete. These updated packages provide a more comprehensive fix to the problem. last seen 2020-06-01 modified 2020-06-02 plugin id 20832 published 2006-02-01 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20832 title Mandrake Linux Security Advisory : gzip (MDKSA-2006:027) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-092.NASL description Several vulnerabilities have been discovered in the gzip package : Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. (CVE-2005-0758) A race condition in gzip 1.2.4, 1.3.3, and earlier when decompressing a gzip file allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. (CVE-2005-0988) A directory traversal vulnerability via last seen 2020-06-01 modified 2020-06-02 plugin id 18308 published 2005-05-19 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18308 title Mandrake Linux Security Advisory : gzip (MDKSA-2005:092) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2007-007.NASL description The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. This update contains several security fixes for the following programs : - bzip2 - CFNetwork - CoreAudio - cscope - gnuzip - iChat - Kerberos - mDNSResponder - PDFKit - PHP - Quartz Composer - Samba - SquirrelMail - Tomcat - WebCore - WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 25830 published 2007-08-02 reporter This script is Copyright (C) 2007-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/25830 title Mac OS X Multiple Vulnerabilities (Security Update 2007-007) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2005-474.NASL description Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. [Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 21829 published 2006-07-03 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21829 title CentOS 3 / 4 : bzip2 (CESA-2005:474) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200505-05.NASL description The remote host is affected by the vulnerability described in GLSA-200505-05 (gzip: Multiple vulnerabilities) The gzip and gunzip programs are vulnerable to a race condition when setting file permissions (CAN-2005-0988), as well as improper handling of filename restoration (CAN-2005-1228). The zgrep utility improperly sanitizes arguments, which may come from an untrusted source (CAN-2005-0758). Impact : These vulnerabilities could allow arbitrary command execution, changing the permissions of arbitrary files, and installation of files to an aribitrary location in the filesystem. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 18231 published 2005-05-11 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18231 title GLSA-200505-05 : gzip: Multiple vulnerabilities NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-474.NASL description Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. [Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 18510 published 2005-06-17 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18510 title RHEL 2.1 / 3 / 4 : bzip2 (RHSA-2005:474) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2005-357.NASL description An updated gzip package is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The gzip package contains the GNU gzip data compression program. A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim. gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0988 to this issue. A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1228 to this issue. Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 21810 published 2006-07-03 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21810 title CentOS 3 / 4 : gzip (CESA-2005:357)
Oval
accepted 2005-09-21T01:33:00.000-04:00 class vulnerability contributors name Jay Beale organization Bastille Linux description zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. family unix id oval:org.mitre.oval:def:1081 status accepted submitted 2005-07-11T12:00:00.000-04:00 title gzip Argument Sanitation Vulnerability version 4 accepted 2005-08-18T07:37:00.000-04:00 class vulnerability contributors name Jay Beale organization Bastille Linux description zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. family unix id oval:org.mitre.oval:def:1107 status accepted submitted 2005-06-20T12:00:00.000-04:00 title gzip zgrep Sanitation Vulnerability version 4 accepted 2013-04-29T04:22:19.557-04:00 class vulnerability contributors name Aharon Chernin organization SCAP.com, LLC name Dragos Prisaca organization G2, Inc.
definition_extensions comment The operating system installed on the system is Red Hat Enterprise Linux 3 oval oval:org.mitre.oval:def:11782 comment CentOS Linux 3.x oval oval:org.mitre.oval:def:16651 comment The operating system installed on the system is Red Hat Enterprise Linux 4 oval oval:org.mitre.oval:def:11831 comment CentOS Linux 4.x oval oval:org.mitre.oval:def:16636 comment Oracle Linux 4.x oval oval:org.mitre.oval:def:15990
description zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. family unix id oval:org.mitre.oval:def:9797 status accepted submitted 2010-07-09T03:56:16-04:00 title zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. version 26
Redhat
| advisories |
| ||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | CVE(CAN) ID: CVE-2004-0996,CVE-2004-2541,CVE-2005-0758,CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-0450,CVE-2007-0478,CVE-2007-1001,CVE-2007-1262,CVE-2007-1358,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717,CVE-2007-1860,CVE-2007-2403,CVE-2007-2404,CVE-2007-2405,CVE-2007-2406,CVE-2007-2407,CVE-2007-2408,CVE-2007-2409,CVE-2007-2410,CVE-2007-2442,CVE-2007-2443,CVE-2007-2446,CVE-2007-2447,CVE-2007-2589,CVE-2007-2798,CVE-2007-3742,CVE-2007-3744,CVE-2007-3745,CVE-2007-3746,CVE-2007-3747,CVE-2007-3748,CVE-2007-3944 Mac OS X是苹果家族计算机所使用的操作系统。 Apple 2007-007安全更新修复了Mac OS X中的多个安全漏洞，远程或本地攻击者可能利用这些漏洞造成多种威胁。 具体条目包括： * CVE-2005-0758 bzgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户bzgrep恶意文件执行任意指令。 * CVE-2007-2403 Mac OS X在处理FTP URI时存在漏洞，攻击者可以诱使用户处理恶意FTP URI的用户在当前FTP会话中执行任意命令。 * CVE-2007-2404 CFNetwork处理HTTP回应数据时易受数据分割攻击的影响，可能导致跨站脚本执行。 * CVE-2007-3745 CoreAudio的Java接口允许释放任意的内存地址，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3746 CoreAudio的Java接口存在堆块边界访问漏洞，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2007-3747 CoreAudio的Java接口允许在堆块以外的内存初始化或操作对象，远程攻击者可能利用此漏洞通过诱使用户访问一个恶意网页控制用户系统。 * CVE-2004-0996,CVE-2004-2541 Cscope存在多个漏洞，包括缓冲区溢出和不安全的方式创建临时文件，可能导致远程攻击者控制系统。 * CVE-2005-0758 zgrep在处理畸形文件名时存在漏洞，攻击者通过诱使用户zgrep恶意文件执行任意指令。 * CVE-2007-3748 iChat使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2442,CVE-2007-2443,CVE-2007-2798 MIT Kerberos kadmind实现上存在多个漏洞，攻击者可能利用这些漏洞导致拒绝服务或执行任意指认。 * CVE-2007-3744 mDNSResponder使用的UPnP IGD代码实现上存在缓冲区溢出漏洞，本地网络上的远程攻击者可能利用此漏洞导致拒绝服务或执行任意指令。 * CVE-2007-2405 Preview处理PDF文件的实现上存在整数溢出漏洞，攻击者可能利用此漏洞诱使用户处理恶意PDF文件控制用户系统。 * CVE-2007-1001,CVE-2007-1287,CVE-2007-1460,CVE-2007-1461,CVE-2007-1484,CVE-2007-1521,CVE-2007-1583,CVE-2007-1711,CVE-2007-1717 PHP的实现上存在多个漏洞，可能导致各种攻击。 * CVE-2007-2406 Quartz Composer实现上存在未初始化对象指针处理漏洞，攻击者可能诱使用户处理恶意文件控制用户系统。 * CVE-2007-2446 Samba的实现在处理畸形的RPC请求时存在堆缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。 * CVE-2007-2447 Samba的实现在处理畸形RPC请求时存在命令注入漏洞，远程攻击者可能利用此漏洞在服务器上执行任意命令。 * CVE-2007-2407 Samba的实现没有正确地处理权限的丢弃，导致磁盘限额绕过。 * CVE-2005-3128,CVE-2006-2842,CVE-2006-3174,CVE-2006-4019,CVE-2006-6142,CVE-2007-1262,CVE-2007-2589 SquirrelMail的实现上存在多个漏洞，可能导致跨站脚本执行。 * CVE-2005-2090,CVE-2007-0450,CVE-2007-1358,CVE-2007-1860 Tomcat实现上存在多个漏洞，可能导致跨站脚本执行和信息泄露。 * CVE-2007-2408 WebCore软件包实现上存在漏洞，可能导致不期望的Java applet执行。 * CVE-2007-0478 WebCore软件包在处理HTML标题的代码上存在漏洞，允许远程用户插入代码。 * CVE-2007-2409,CVE-2007-2410 WebCore软件包的实现上存在漏洞，可能导致浏览器信息泄露。 * CVE-2007-3742 WebKit软件包实现上存在漏洞，可能导致域名欺骗。 * CVE-2007-3944 Safari的JavaScript引擎使用的PCRE库实现上存在堆溢出漏洞，远程攻击者可能利用此漏洞通过诱使用户访问恶意网页控制用户系统。 Apple MacOS X 厂商补丁： Apple ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href="http://docs.info.apple.com/article.html?artnum=306172" target="_blank">http://docs.info.apple.com/article.html?artnum=306172</a> |
| id | SSV:2062 |
| last seen | 2017-11-19 |
| modified | 2007-08-02 |
| published | 2007-08-02 |
| reporter | Root |
| title | Mac OS X 2007-007更新修复多个安全漏洞 |
Statements
| contributor | Mark J Cox |
| lastmodified | 2007-03-14 |
| organization | Red Hat |
| statement | Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
References
- ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.58/SCOSA-2005.58.txt
- ftp://patches.sgi.com/support/free/security/advisories/20060301-01.U.asc
- http://bugs.gentoo.org/show_bug.cgi?id=90626
- http://docs.info.apple.com/article.html?artnum=306172
- http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
- http://rhn.redhat.com/errata/RHSA-2005-357.html
- http://secunia.com/advisories/18100
- http://secunia.com/advisories/19183
- http://secunia.com/advisories/22033
- http://secunia.com/advisories/26235
- http://securitytracker.com/id?1013928
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.555852
- http://www.fedoralegacy.org/updates/FC2/2005-11-14-FLSA_2005_158801__Updated_bzip2_packages_fix_security_issues.html
- http://www.gentoo.org/security/en/glsa/glsa-200505-05.xml
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:026
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:027
- http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.002.html
- http://www.osvdb.org/16371
- http://www.redhat.com/support/errata/RHSA-2005-474.html
- http://www.securityfocus.com/bid/13582
- http://www.securityfocus.com/bid/25159
- http://www.ubuntu.com/usn/usn-158-1
- http://www.vupen.com/english/advisories/2007/2732
- https://exchange.xforce.ibmcloud.com/vulnerabilities/20539
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1081
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1107
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9797