CVE-2010-0405 - Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 a

CVE-2010-0405

Summary

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

References

Vulnerable Configurations

cpe:2.3:a:bzip:bzip2:0.9:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.0c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_d:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5_d:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5d:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9.5d:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_a:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_b:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:0.9_c:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:bzip:bzip2:1.0.5:*:*:*:*:*:*:*
cpe:2.3:a:libzip2:libzip2:*:*:*:*:*:*:*:*
cpe:2.3:a:libzip2:libzip2:*:*:*:*:*:*:*:*

CVSS

Base:	5.1 (as of 10-10-2018 - 19:52)
Impact:
Exploitability:

CWE

CWE-189

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:P

redhat via4

advisories

bugzilla

id	627882
title	CVE-2010-0405 bzip2: integer overflow flaw in BZ2_decompress

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 4 is installed
oval oval:com.redhat.rhba:tst:20070304025

AND
comment bzip2 is earlier than 0:1.0.2-16.el4_8
oval oval:com.redhat.rhsa:tst:20100703001
comment bzip2 is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20080893002
AND
comment bzip2-devel is earlier than 0:1.0.2-16.el4_8
oval oval:com.redhat.rhsa:tst:20100703003
comment bzip2-devel is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20080893004
AND
comment bzip2-libs is earlier than 0:1.0.2-16.el4_8
oval oval:com.redhat.rhsa:tst:20100703005
comment bzip2-libs is signed with Red Hat master key
oval oval:com.redhat.rhsa:tst:20080893006

AND

comment Red Hat Enterprise Linux 5 is installed
oval oval:com.redhat.rhba:tst:20070331005

AND
comment bzip2 is earlier than 0:1.0.3-6.el5_5
oval oval:com.redhat.rhsa:tst:20100703008
comment bzip2 is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20080893009
AND
comment bzip2-devel is earlier than 0:1.0.3-6.el5_5
oval oval:com.redhat.rhsa:tst:20100703010
comment bzip2-devel is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20080893011
AND
comment bzip2-libs is earlier than 0:1.0.3-6.el5_5
oval oval:com.redhat.rhsa:tst:20100703012
comment bzip2-libs is signed with Red Hat redhatrelease key
oval oval:com.redhat.rhsa:tst:20080893013

rhsa

id	RHSA-2010:0703
released	2010-09-21
severity	Important
title	RHSA-2010:0703: bzip2 security update (Important)

bugzilla

id	627882
title	CVE-2010-0405 bzip2: integer overflow flaw in BZ2_decompress

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment bzip2 is earlier than 0:1.0.5-7.el6_0
oval oval:com.redhat.rhsa:tst:20100858001
comment bzip2 is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100858002
AND
comment bzip2-devel is earlier than 0:1.0.5-7.el6_0
oval oval:com.redhat.rhsa:tst:20100858003
comment bzip2-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100858004
AND
comment bzip2-libs is earlier than 0:1.0.5-7.el6_0
oval oval:com.redhat.rhsa:tst:20100858005
comment bzip2-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100858006

rhsa

id	RHSA-2010:0858
released	2010-11-10
severity	Important
title	RHSA-2010:0858: bzip2 security update (Important)

rpms

bzip2-0:1.0.2-14.EL3
bzip2-0:1.0.2-16.el4_8
bzip2-0:1.0.3-6.el5_5
bzip2-debuginfo-0:1.0.2-14.EL3
bzip2-debuginfo-0:1.0.2-16.el4_8
bzip2-debuginfo-0:1.0.3-6.el5_5
bzip2-devel-0:1.0.2-14.EL3
bzip2-devel-0:1.0.2-16.el4_8
bzip2-devel-0:1.0.3-6.el5_5
bzip2-libs-0:1.0.2-14.EL3
bzip2-libs-0:1.0.2-16.el4_8
bzip2-libs-0:1.0.3-6.el5_5
bzip2-0:1.0.5-7.el6_0
bzip2-debuginfo-0:1.0.5-7.el6_0
bzip2-devel-0:1.0.5-7.el6_0
bzip2-libs-0:1.0.5-7.el6_0

refmap via4

apple	APPLE-SA-2011-03-21-1
bugtraq	20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console
confirm	http://blogs.sun.com/security/entry/cve_2010_0405_integer_overflow http://git.clamav.net/gitweb?p=clamav-devel.git;a=blob_plain;f=ChangeLog;hb=clamav-0.96.3 http://support.apple.com/kb/HT4581 http://www.bzip.org/ http://www.vmware.com/security/advisories/VMSA-2010-0019.html http://xorl.wordpress.com/2010/09/21/cve-2010-0405-bzip2-integer-overflow/ https://bugzilla.redhat.com/show_bug.cgi?id=627882 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2230 https://wwws.clamav.net/bugzilla/show_bug.cgi?id=2231
fedora	FEDORA-2010-1512 FEDORA-2010-17439
gentoo	GLSA-201301-05
mlist	[oss-security] 20100921 bzip2 CVE-2010-0405 integer overflow
secunia	41452 41505 42350 42404 42405 42529 42530 48378
suse	SUSE-SR:2010:018
ubuntu	USN-986-1 USN-986-2 USN-986-3
vupen	ADV-2010-2455 ADV-2010-3043 ADV-2010-3052 ADV-2010-3073 ADV-2010-3126 ADV-2010-3127

Last major update

10-10-2018 - 19:52

Published

28-09-2010 - 18:00

Last modified

10-10-2018 - 19:52