User: Password:
|
|
Subscribe / Log in / New account

Fedora-Legacy alert FLSA:157696 (gzip)

From:  Marc Deslauriers <marcdeslauriers@videotron.ca>
To:  bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject:  [FLSA-2005:157696] Updated gzip package fixes security issues
Date:  Wed, 10 Aug 2005 19:48:01 -0400

--------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated gzip package fixes security issues Advisory ID: FLSA:157696 Issue date: 2005-08-10 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CAN-2005-0758 CAN-2005-0988 CAN-2005-1228 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: An updated gzip package is now available. The gzip package contains the GNU gzip data compression program. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue. A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim, gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0988 to this issue. A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1228 to this issue. Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=157696 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS... i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/... Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/g... i386: http://download.fedoralegacy.org/redhat/9/updates/i386/gz... Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/g... i386: http://download.fedoralegacy.org/fedora/1/updates/i386/gz... Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/g... i386: http://download.fedoralegacy.org/fedora/2/updates/i386/gz... 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 16a19e2142d83f1db86dbf5a9a5a0b4e35d50c92 redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm 98e5fcc727442dd531277cffc2771b7bc8d5f1f8 redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm 7960019da89fbdee222e71b7d9884e6dc9ed3056 redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm de3e4e8dd934c383feb2a464b522c4e62bdd3f6d redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm b5cc020182af4b945a461c35e1adc3ddb15e953b fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm 28c8700ac53cb6f8110c744ffc8456095cf9d051 fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm 3d056ec2af5e344ef56e22049e5bd196f0c27180 fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm f6b4d52075528761fd56e44c8227c45130f959b0 fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228 9. Contact: The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org ---------------------------------------------------------------------


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds