gzip: arbitrary command execution [LWN.net]

Package(s):

gzip

CVE #(s):

CAN-2005-0758

Created:

August 1, 2005

Updated:

January 10, 2007

Description:

zgrep in gzip before 1.3.5 does not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names.

Alerts:

OpenPKG	OpenPKG-SA-2007.002	2007-01-08
Mandriva	MDKSA-2006:027	2006-01-30
Mandriva	MDKSA-2006:026	2006-01-30
Fedora-Legacy	FLSA:158801	2005-11-14
Fedora-Legacy	FLSA:157696	2005-08-10
Ubuntu	USN-161-1	2005-08-04
Ubuntu	USN-158-1	2005-08-01

(Log in to post comments)

gzip: arbitrary command execution

Posted Aug 6, 2005 3:11 UTC (Sat) by roelofs (guest, #2599) [Link]

USN-161-1 applies to bzgrep in the bzip2 package, not gzip. Both scripts had the same problem.

Greg

gzip: arbitrary command execution

Posted Nov 17, 2005 9:56 UTC (Thu) by mjcox@redhat.com (subscriber, #31775) [Link]

fixed by RHSA-2005:357 on 20050713
fixed by FEDORA-2005-471 for Fedora Core 3 (FC4 wasn't affected)