ID CVE-2005-0953
Summary Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
References
Vulnerable Configurations
  • cpe:2.3:a:bzip:bzip2:0.9
    cpe:2.3:a:bzip:bzip2:0.9
  • cpe:2.3:a:bzip:bzip2:0.9.5_a
    cpe:2.3:a:bzip:bzip2:0.9.5_a
  • cpe:2.3:a:bzip:bzip2:0.9.5_b
    cpe:2.3:a:bzip:bzip2:0.9.5_b
  • cpe:2.3:a:bzip:bzip2:0.9.5_c
    cpe:2.3:a:bzip:bzip2:0.9.5_c
  • cpe:2.3:a:bzip:bzip2:0.9.5_d
    cpe:2.3:a:bzip:bzip2:0.9.5_d
  • cpe:2.3:a:bzip:bzip2:0.9_a
    cpe:2.3:a:bzip:bzip2:0.9_a
  • cpe:2.3:a:bzip:bzip2:0.9_b
    cpe:2.3:a:bzip:bzip2:0.9_b
  • cpe:2.3:a:bzip:bzip2:0.9_c
    cpe:2.3:a:bzip:bzip2:0.9_c
  • cpe:2.3:a:bzip:bzip2:1.0
    cpe:2.3:a:bzip:bzip2:1.0
  • cpe:2.3:a:bzip:bzip2:1.0.1
    cpe:2.3:a:bzip:bzip2:1.0.1
  • cpe:2.3:a:bzip:bzip2:1.0.2
    cpe:2.3:a:bzip:bzip2:1.0.2
CVSS
Base: 3.7 (as of 13-06-2005 - 14:45)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
LOCAL HIGH NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2005-474.NASL
    description Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. [Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 18510
    published 2005-06-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=18510
    title RHEL 2.1 / 3 / 4 : bzip2 (RHSA-2005:474)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2005-091.NASL
    description A race condition in the file permission restore code of bunzip2 was discovered by Imran Ghory. While a user was decompressing a file, a local attacker with write permissions to the directory containing the compressed file could replace the target file with a hard link which would cause bunzip2 to restore the file permissions of the original file to the hard link target. This could be exploited to gain read or write access to files of other users (CVE-2005-0953). A vulnerability was found where specially crafted bzip2 archives would cause an infinite loop in the decompressor, resulting in an indefinitively large output file (also known as a 'decompression bomb'). This could be exploited to cause a Denial of Service attack on the host computer due to disk space exhaustion (CVE-2005-1260). The provided packages have been patched to correct these issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 18307
    published 2005-05-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=18307
    title Mandrake Linux Security Advisory : bzip2 (MDKSA-2005:091)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_197F444FE8EF11D9B8750001020EED82.NASL
    description Problem Description Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop. Second, when creating a new file, bzip2 closes the file before setting its permissions. Impact The first problem can cause bzip2 to extract a bzip2 archive to an infinitely large file. If bzip2 is used in automated processing of untrusted files this could be exploited by an attacker to create an denial-of-service situation by exhausting disk space or by consuming all available cpu time. The second problem can allow a local attacker to change the permissions of local files owned by the user executing bzip2 providing that they have write access to the directory in which the file is being extracted. Workaround Do not uncompress bzip2 archives from untrusted sources and do not uncompress files in directories where untrusted users have write access.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 18853
    published 2005-07-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=18853
    title FreeBSD : bzip2 -- denial of service and permission race vulnerabilities (197f444f-e8ef-11d9-b875-0001020eed82)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_4_11.NASL
    description The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.11 or a version of Mac OS X 10.3 which does not have Security Update 2007-008 applied. This update contains several security fixes for the following programs : - Flash Player Plugin - AppleRAID - BIND - bzip2 - CFFTP - CFNetwork - CoreFoundation - CoreText - Kerberos - Kernel - remote_cmds - Networking - NFS - NSURL - Safari - SecurityAgent - WebCore - WebKit
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 28212
    published 2007-11-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=28212
    title Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2005-474.NASL
    description Updated bzip2 packages that fix multiple issues are now available. This update has been rated as having low security impact by the Red Hat Security Response Team. [Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758. Bzip2 is a data compressor. A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue. A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953). A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260). Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 21829
    published 2006-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=21829
    title CentOS 3 / 4 : bzip2 (CESA-2005:474)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-730.NASL
    description Imran Ghory discovered a race condition in bzip2, a high-quality block-sorting file compressor and decompressor. When decompressing a file in a directory an attacker has access to, bunzip2 could be tricked to set the file permissions to a different file the user has permissions to.
    last seen 2019-02-21
    modified 2018-07-20
    plugin id 18517
    published 2005-06-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=18517
    title Debian DSA-730-1 : bzip2 - race condition
  • NASL family Mandriva Local Security Checks
    NASL id MANDRAKE_MDKSA-2006-026.NASL
    description A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep. As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched. The updated packages have been patched to correct these problems.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 20831
    published 2006-02-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=20831
    title Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-127-1.NASL
    description Imran Ghory discovered a race condition in the file permission restore code of bunzip2. While a user was decompressing a file, a local attacker with write permissions in the directory of that file could replace the target file with a hard link. This would cause bzip2 to restore the file permissions to the hard link target instead of to the bzip2 output file, which could be exploited to gain read or even write access to files of other users. (CAN-2005-0953) Specially crafted bzip2 archives caused an infinite loop in the decompressor which resulted in an indefinitively large output file ('decompression bomb'). This could be exploited to a Denial of Service attack due to disk space exhaustion on systems which automatically process user-supplied bzip2 compressed files. (CAN-2005-1260). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 20517
    published 2006-01-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=20517
    title Ubuntu 4.10 / 5.04 : bzip2 vulnerabilities (USN-127-1)
oval via4
  • accepted 2013-04-29T04:09:51.473-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
    family unix
    id oval:org.mitre.oval:def:10902
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
    version 23
  • accepted 2005-09-21T01:33:00.000-04:00
    class vulnerability
    contributors
    name Jay Beale
    organization Bastille Linux
    description Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
    family unix
    id oval:org.mitre.oval:def:1154
    status accepted
    submitted 2005-07-11T12:00:00.000-04:00
    title bzip2 Arbitrary File Permission Modification Vulnerability
    version 4
redhat via4
advisories
rhsa
id RHSA-2005:474
refmap via4
apple APPLE-SA-2007-11-14
bid
  • 12954
  • 26444
bugtraq
  • 20050330 bzip2 TOCTOU file-permissions vulnerability
  • 20070109 rPSA-2007-0004-1 bzip2
cert TA07-319A
confirm http://docs.info.apple.com/article.html?artnum=307041
debian DSA-730
fedora FLSA:158801
mandriva MDKSA-2006:026
netbsd NetBSD-SA2008-004
openpkg OpenPKG-SA-2007.002
secunia
  • 19183
  • 27274
  • 27643
  • 29940
sgi 20060301-01-U
sunalert
  • 103118
  • 200191
vupen
  • ADV-2007-3525
  • ADV-2007-3868
xf bzip2-toctou-symlink(19926)
statements via4
contributor Mark J Cox
lastmodified 2007-03-14
organization Red Hat
statement Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Last major update 17-10-2016 - 23:15
Published 02-05-2005 - 00:00
Last modified 19-10-2018 - 11:31
Back to Top