Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.

SunOS 5.9_x86: patchadd and patchrm Patch.
Date this patch was last updated by Sun : Jul/02/10

SunOS 5.9: patchadd and patchrm Patch.
Date this patch was last updated by Sun : Jul/02/10

If a ZIP archive contains binaries with the setuid and/or setgid bit set, unzip preserved those bits when extracting the archive. This could be exploited by tricking the administrator into unzipping an archive with a setuid-root binary into a directory the attacker can access. This allowed the attacker to execute arbitrary commands with root privileges.

The updated version does not preserve setuid, setgid, and sticky bits any more by default. The old behaviour can be explicitly requested now by supplying the option '-K'.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges. (CVE-2005-0602)

Imran Ghory found a race condition in the handling of output files.
While a file was unpacked by unzip, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the unzip user. This affects versions of unzip 5.52 and lower (CVE-2005-2475)

The updated packages have been patched to address these issues.

SunOS 5.8_x86: Patch for patchadd and patc.
Date this patch was last updated by Sun : Nov/30/07

SunOS 5.8: Patch for patchadd and patchrm.
Date this patch was last updated by Sun : Nov/30/07

ID	Name	Product	Family	Severity
29211	Solaris 9 (x86) : 114194-12	Nessus	Solaris Local Security Checks	medium
29209	Solaris 9 (sparc) : 112951-15	Nessus	Solaris Local Security Checks	medium
20563	Ubuntu 4.10 / 5.04 : unzip vulnerability (USN-159-1)	Nessus	Ubuntu Local Security Checks	medium
20125	Mandrake Linux Security Advisory : unzip (MDKSA-2005:197)	Nessus	Mandriva Local Security Checks	medium
13417	Solaris 8 (x86) : 108988-19	Nessus	Solaris Local Security Checks	medium
13307	Solaris 8 (sparc) : 108987-19	Nessus	Solaris Local Security Checks	medium

Detections

Analytics

CVE-2005-0602

high

Tenable Plugins

medium

medium

medium

medium

medium

medium