zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

The remote host is running a version of Mac OS X 10.4 or 10.3 which does not have the security update 2007-007 applied. 

This update contains several security fixes for the following programs :

 - bzip2
 - CFNetwork
 - CoreAudio
 - cscope
 - gnuzip
 - iChat
 - Kerberos
 - mDNSResponder
 - PDFKit
 - PHP
 - Quartz Composer
 - Samba
 - SquirrelMail
 - Tomcat
 - WebCore
 - WebKit

New gzip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix possible security issues.

Updated bzip2 packages that fix multiple issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

[Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758.

Bzip2 is a data compressor.

A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue.

A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953).

A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260).

Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues.

An updated gzip package is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue.

A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim. gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0988 to this issue.

A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1228 to this issue.

Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues.

Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

This was previously corrected in MDKSA-2005:092, however the fix was incomplete. These updated packages provide a more comprehensive fix to the problem.

A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep.

As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched.

The updated packages have been patched to correct these problems.

USN-158-1 fixed a command injection vulnerability in the 'zgrep' utility. It was determined that the 'bzgrep' counterpart in the bzip2 package is vulnerable to the same flaw.

bzgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if bzgrep was run in an untrusted directory with specially crafted file names.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

zgrep did not handle shell metacharacters like '|' and '&' properly when they occurred in input file names. This could be exploited to execute arbitrary commands with user privileges if zgrep is run in an untrusted directory with specially crafted file names.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:474 advisory.

    Bzip2 is a data compressor.

    A bug was found in the way bzgrep processes file names. If a user can be     tricked into running bzgrep on a file with a carefully crafted file name,     arbitrary commands could be executed as the user running bzgrep. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CVE-2005-0758 to this issue.

    A bug was found in the way bzip2 modifies file permissions during     decompression. If an attacker has write access to the directory into which     bzip2 is decompressing files, it is possible for them to modify permissions     on files owned by the user running bzip2 (CVE-2005-0953).

    A bug was found in the way bzip2 decompresses files. It is possible for an     attacker to create a specially crafted bzip2 file which will cause bzip2 to     cause a denial of service (by filling disk space) if decompressed by a     victim (CVE-2005-1260).

    Users of Bzip2 should upgrade to these updated packages, which contain     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2005:357 advisory.

    The gzip package contains the GNU gzip data compression program.

    A bug was found in the way zgrep processes file names. If a user can be     tricked into running zgrep on a file with a carefully crafted file name,     arbitrary commands could be executed as the user running zgrep. The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2005-0758 to this issue.

    A bug was found in the way gunzip modifies permissions of files being     decompressed. A local attacker with write permissions in the directory in     which a victim is decompressing a file could remove the file being written     and replace it with a hard link to a different file owned by the victim.
    gunzip then gives the linked file the permissions of the uncompressed file.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0988 to this issue.

    A directory traversal bug was found in the way gunzip processes the -N     flag. If a victim decompresses a file with the -N flag, gunzip fails to     sanitize the path which could result in a file owned by the victim being     overwritten. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-1228 to this issue.

    Users of gzip should upgrade to this updated package, which contains     backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in the gzip package :

Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script. (CVE-2005-0758)

A race condition in gzip 1.2.4, 1.3.3, and earlier when decompressing a gzip file allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete. (CVE-2005-0988)

A directory traversal vulnerability via 'gunzip -N' in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file. (CVE-2005-1228)

Updated packages are patched to address these issues.

The remote host is affected by the vulnerability described in GLSA-200505-05 (gzip: Multiple vulnerabilities)

    The gzip and gunzip programs are vulnerable to a race condition     when setting file permissions (CAN-2005-0988), as well as improper     handling of filename restoration (CAN-2005-1228). The zgrep utility     improperly sanitizes arguments, which may come from an untrusted source     (CAN-2005-0758).
  Impact :

    These vulnerabilities could allow arbitrary command execution,     changing the permissions of arbitrary files, and installation of files     to an aribitrary location in the filesystem.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
25830	Mac OS X Multiple Vulnerabilities (Security Update 2007-007)	Nessus	MacOS X Local Security Checks	critical
22421	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : gzip (SSA:2006-262-01)	Nessus	Slackware Local Security Checks	high
21829	CentOS 3 / 4 : bzip2 (CESA-2005:474)	Nessus	CentOS Local Security Checks	medium
21810	CentOS 3 / 4 : gzip (CESA-2005:357)	Nessus	CentOS Local Security Checks	medium
20832	Mandrake Linux Security Advisory : gzip (MDKSA-2006:027)	Nessus	Mandriva Local Security Checks	medium
20831	Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026)	Nessus	Mandriva Local Security Checks	medium
20567	Ubuntu 4.10 / 5.04 : bzip2 vulnerability (USN-161-1)	Nessus	Ubuntu Local Security Checks	medium
20562	Ubuntu 4.10 / 5.04 : gzip vulnerability (USN-158-1)	Nessus	Ubuntu Local Security Checks	medium
18510	RHEL 4 : bzip2 (RHSA-2005:474)	Nessus	Red Hat Local Security Checks	medium
18469	RHEL 4 : gzip (RHSA-2005:357)	Nessus	Red Hat Local Security Checks	high
18308	Mandrake Linux Security Advisory : gzip (MDKSA-2005:092)	Nessus	Mandriva Local Security Checks	medium
18231	GLSA-200505-05 : gzip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-0758

critical

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium

medium

high

medium

medium