Message-ID: <42FA9231.4090403@videotron.ca>
Date: Wed, 10 Aug 2005 19:48:01 -0400
From: Marc Deslauriers <marcdeslauriers@...eotron.ca>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [FLSA-2005:157696] Updated gzip package fixes
	security issues

---------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated gzip package fixes security issues
Advisory ID:       FLSA:157696
Issue date:        2005-08-10
Product:           Red Hat Linux, Fedora Core
Keywords:          Bugfix
CVE Names:         CAN-2005-0758 CAN-2005-0988 CAN-2005-1228
---------------------------------------------------------------------


---------------------------------------------------------------------
1. Topic:

An updated gzip package is now available.

The gzip package contains the GNU gzip data compression program.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386

3. Problem description:

A bug was found in the way zgrep processes file names. If a user can be
tricked into running zgrep on a file with a carefully crafted file name,
arbitrary commands could be executed as the user running zgrep. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0758 to this issue.

A bug was found in the way gunzip modifies permissions of files being
decompressed. A local attacker with write permissions in the directory
in which a victim is decompressing a file could remove the file being
written and replace it with a hard link to a different file owned by the
victim, gunzip then gives the linked file the permissions of the
uncompressed file. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0988 to this issue.

A directory traversal bug was found in the way gunzip processes the -N
flag. If a victim decompresses a file with the -N flag, gunzip fails to
sanitize the path which could result in a file owned by the victim being
overwritten. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-1228 to this issue.

Users of gzip should upgrade to this updated package, which contains
backported patches to correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=157696

6. RPMs required:

Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm

Fedora Core 2:

SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm


7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------

16a19e2142d83f1db86dbf5a9a5a0b4e35d50c92
redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
98e5fcc727442dd531277cffc2771b7bc8d5f1f8
redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
7960019da89fbdee222e71b7d9884e6dc9ed3056
redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
de3e4e8dd934c383feb2a464b522c4e62bdd3f6d
redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
b5cc020182af4b945a461c35e1adc3ddb15e953b
fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
28c8700ac53cb6f8110c744ffc8456095cf9d051
fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
3d056ec2af5e344ef56e22049e5bd196f0c27180
fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
f6b4d52075528761fd56e44c8227c45130f959b0
fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists