bugtraq - gzip directory traversal vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 20 Apr 2005 20:24:42 +0100
From: Imran Ghory <imranghory@...il.com>
To: bugtraq@...urityfocus.com
Subject: gzip directory traversal vulnerability

================================
gzip directory traversal vulnerability
================================

Software: gzip
Version: 1.2.4, 1.3.3
Software URL: <http://www.gzip.org>
Platform:  Unix, Linux.
Vulnerability type: Input validation
Severity: Medium, local vuln, requires user using gunzip -N on a
malicious zip file. Can result in privilege escalation.

Vulnerable software
====================

gzip 1.2.4 and 1.3.3 and previous versions running on unix.

Vulnerability
==============

Ulf Härnhammar <metaur@...ia.com> has discovered a vulnerability in
gunzip that allows a malicious zip file to extract to an arbitrary
directory of the attackers choice when gunzip is used with the -N
option.

Further details of this vulnerability are available in the Debian bug
report #305255.

Direct link: <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255>

This vulnerability can be used to make the gzip file extract to a
directory which the attacker has write access to. This vulnerability
then be used in combination with the gzip TOCTOU file-permissions
vulnerability (CAN-2005-0988, Bugtraq #12996) to change the
permissions on arbitrary files belonging to the user.

Fix
====

A patch developed by Ulf Härnhammar is linked to from the bug report
link given above.