[38473] in bugtraq
gzip directory traversal vulnerability
daemon@ATHENA.MIT.EDU (Imran Ghory)
Wed Apr 20 16:01:14 2005
Message-ID: <7389fc4b0504201224759f31b@mail.gmail.com>
Date: Wed, 20 Apr 2005 20:24:42 +0100
From: Imran Ghory <imranghory@gmail.com>
Reply-To: Imran Ghory <imranghory@gmail.com>
To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
================================
gzip directory traversal vulnerability
================================
Software: gzip
Version: 1.2.4, 1.3.3
Software URL: <http://www.gzip.org>
Platform: Unix, Linux.
Vulnerability type: Input validation
Severity: Medium, local vuln, requires user using gunzip -N on a
malicious zip file. Can result in privilege escalation.
Vulnerable software
====================
gzip 1.2.4 and 1.3.3 and previous versions running on unix.
Vulnerability
==============
Ulf Härnhammar <metaur@telia.com> has discovered a vulnerability in
gunzip that allows a malicious zip file to extract to an arbitrary
directory of the attackers choice when gunzip is used with the -N
option.
Further details of this vulnerability are available in the Debian bug
report #305255.
Direct link: <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255>
This vulnerability can be used to make the gzip file extract to a
directory which the attacker has write access to. This vulnerability
then be used in combination with the gzip TOCTOU file-permissions
vulnerability (CAN-2005-0988, Bugtraq #12996) to change the
permissions on arbitrary files belonging to the user.
Fix
====
A patch developed by Ulf Härnhammar is linked to from the bug report
link given above.
