[Full-disclosure] [FLSA-2005:157696] Updated gzip package fixes security issues

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 08/11/05

  • Next message: Marc Deslauriers: "[Full-disclosure] [FLSA-2005:152889] Updated mc packages fix security issues" 
    Date: Wed, 10 Aug 2005 19:48:01 -0400
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk

    ---------------------------------------------------------------------
                   Fedora Legacy Update Advisory

    Synopsis: Updated gzip package fixes security issues
    Advisory ID: FLSA:157696
    Issue date: 2005-08-10
    Product: Red Hat Linux, Fedora Core
    Keywords: Bugfix
    CVE Names: CAN-2005-0758 CAN-2005-0988 CAN-2005-1228
    ---------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    An updated gzip package is now available.

    The gzip package contains the GNU gzip data compression program.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386
    Fedora Core 1 - i386
    Fedora Core 2 - i386

    3. Problem description:

    A bug was found in the way zgrep processes file names. If a user can be
    tricked into running zgrep on a file with a carefully crafted file name,
    arbitrary commands could be executed as the user running zgrep. The
    Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2005-0758 to this issue.

    A bug was found in the way gunzip modifies permissions of files being
    decompressed. A local attacker with write permissions in the directory
    in which a victim is decompressing a file could remove the file being
    written and replace it with a hard link to a different file owned by the
    victim, gunzip then gives the linked file the permissions of the
    uncompressed file. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2005-0988 to this issue.

    A directory traversal bug was found in the way gunzip processes the -N
    flag. If a victim decompresses a file with the -N flag, gunzip fails to
    sanitize the path which could result in a file owned by the victim being
    overwritten. The Common Vulnerabilities and Exposures project
    (cve.mitre.org) has assigned the name CAN-2005-1228 to this issue.

    Users of gzip should upgrade to this updated package, which contains
    backported patches to correct these issues.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www.fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=157696

    6. RPMs required:

    Red Hat Linux 7.3:
    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm

    Fedora Core 1:

    SRPM:
    http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm

    Fedora Core 2:

    SRPM:
    http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------

    16a19e2142d83f1db86dbf5a9a5a0b4e35d50c92
    redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
    98e5fcc727442dd531277cffc2771b7bc8d5f1f8
    redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
    7960019da89fbdee222e71b7d9884e6dc9ed3056
    redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
    de3e4e8dd934c383feb2a464b522c4e62bdd3f6d
    redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
    b5cc020182af4b945a461c35e1adc3ddb15e953b
    fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
    28c8700ac53cb6f8110c744ffc8456095cf9d051
    fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
    3d056ec2af5e344ef56e22049e5bd196f0c27180
    fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
    f6b4d52075528761fd56e44c8227c45130f959b0
    fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy.org/about/security.php

    You can verify each package with the following command:

        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

        sha1sum <filename>

    8. References:

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Marc Deslauriers: "[Full-disclosure] [FLSA-2005:152889] Updated mc packages fix security issues"

    Relevant Pages