[USN-18-1] zip vulnerability

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 11/05/04

  • Next message: Graham, Brian: "FW: Hacker Group back again, this time claiming to have source code to Cisco PIX firewall" 
    Date: Fri, 5 Nov 2004 18:14:47 +0100
To: ubuntu-security-announce@lists.ubuntu.com

    ===========================================================
    Ubuntu Security Notice USN-18-1 November 05, 2004
    zip vulnerability
    CAN-2004-1010
    ===========================================================

    A security issue affects the following Ubuntu releases:

    Ubuntu 4.10 (Warty Warthog)

    The following packages are affected:

    zip

    The problem can be corrected by upgrading the affected package to
    version 2.30-6ubuntu0.1. In general, a standard system upgrade is
    sufficient to effect the necessary changes.

    Details follow:

    HexView discovered a buffer overflow in the zip package. The overflow
    is triggered by creating a ZIP archive of files with very long path
    names. This vulnerability might result in execution of arbitrary code
    with the privileges of the user who calls zip.

    This flaw may lead to privilege escalation on systems which
    automatically create ZIP archives of user supplied files, like backup
    systems or web applications.

      Source archives:

        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30-6ubuntu0.1.diff.gz
          Size/MD5: 15683 dd26c4c85464bff935f39d72d5704589
        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30-6ubuntu0.1.dsc
          Size/MD5: 526 ff598e352d1e70b35a06d93583557270
        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30.orig.tar.gz
          Size/MD5: 728636 9426b2042139de1f112f271ebdcb0ff0

      amd64 architecture (Athlon64, Opteron, EM64T Xeon)

        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30-6ubuntu0.1_amd64.deb
          Size/MD5: 101572 36e834cfe5405bf2a92abdf0b3d4067b

      i386 architecture (x86 compatible Intel/AMD)

        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30-6ubuntu0.1_i386.deb
          Size/MD5: 91602 abd725fa35fc9c4482da1ca32cf9d374

      powerpc architecture (Apple Macintosh G3/G4/G5)

        http://security.ubuntu.com/ubuntu/pool/main/z/zip/zip_2.30-6ubuntu0.1_powerpc.deb
          Size/MD5: 96648 9f8b310ae415756a1a629bc6bccf1f70

  • Next message: Graham, Brian: "FW: Hacker Group back again, this time claiming to have source code to Cisco PIX firewall"

    Relevant Pages

    • [Full-Disclosure] [USN-18-1] zip vulnerability
      ... Ubuntu 4.10 ... The problem can be corrected by upgrading the affected package to ... HexView discovered a buffer overflow in the zip package. ... This vulnerability might result in execution of arbitrary code ...
      (Full-Disclosure)
    • [USN-18-1] zip vulnerability
      ... Ubuntu 4.10 ... The problem can be corrected by upgrading the affected package to ... HexView discovered a buffer overflow in the zip package. ... This vulnerability might result in execution of arbitrary code ...
      (Full-Disclosure)
    • [Full-disclosure] [USN-113-1] libnet-ssleay-perl vulnerability
      ... Ubuntu 5.04 ... The problem can be corrected by upgrading the affected package to version ...
      (Full-Disclosure)
    • [USN-113-1] libnet-ssleay-perl vulnerability
      ... Ubuntu 5.04 ... The problem can be corrected by upgrading the affected package to version ...
      (Bugtraq)
    • [USN-55-1] imlib2 vulnerabilities
      ... Ubuntu 4.10 ... The problem can be corrected by upgrading the affected package to ... These vulnerabilities might also lead to privilege escalation if a ...
      (Full-Disclosure)
    • Quantcast