Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.

From Red Hat Security Advisory 2007:0203 :

Updated unzip packages that fix two security issues and various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The unzip utility is used to list, test, or extract files from a zip archive.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

As well, this update adds support for files larger than 2GB.

All users of unzip should upgrade to these updated packages, which contain backported patches that resolve these issues.

Updated unzip packages that fix two security issues and various bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The unzip utility is used to list, test, or extract files from a zip archive.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

As well, this update adds support for files larger than 2GB.

All users of unzip should upgrade to these updated packages, which contain backported patches that resolve these issues.

A race condition was found in Unzip. Local users could use this flaw to modify permissions of arbitrary files via a hard link attack on a file while it was being decompressed (CVE-2005-2475)

A buffer overflow was found in Unzip command line argument handling.
If a user could be tricked into running Unzip with a specially crafted long file name, an attacker could execute arbitrary code with that user's privileges. (CVE-2005-4667)

The unzip update in DSA 903 contained a regression so that symbolic links that are resolved later in a zip archive aren't supported anymore.  This update corrects this behaviour.  For completeness, below please find the original advisory text :

  Imran Ghory discovered a race condition in the permissions setting   code in unzip. When decompressing a file in a directory an attacker   has access to, unzip could be tricked to set the file permissions to   a different file the user has permissions to.

Imran Ghory reports a vulnerability within unzip. The vulnerability is caused by a race condition between extracting an archive and changing the permissions of the extracted files. This would give an attacker enough time to remove a file and hardlink it to another file owned by the user running unzip. When unzip changes the permissions of the file it could give the attacker access to files that normally would not have been accessible for others.

Imran Ghory found a race condition in the handling of output files.
While a file was unpacked by unzip, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the unzip user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges. (CVE-2005-0602)

Imran Ghory found a race condition in the handling of output files.
While a file was unpacked by unzip, a local attacker with write permissions to the target directory could exploit this to change the permissions of arbitrary files of the unzip user. This affects versions of unzip 5.52 and lower (CVE-2005-2475)

The updated packages have been patched to address these issues.

ID	Name	Product	Family	Severity
67473	Oracle Linux 4 : unzip (ELSA-2007-0203)	Nessus	Oracle Linux Local Security Checks	low
67039	CentOS 4 : unzip (CESA-2007:0203)	Nessus	CentOS Local Security Checks	low
60171	Scientific Linux Security Update : unzip on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
25135	RHEL 4 : unzip (RHSA-2007:0203)	Nessus	Red Hat Local Security Checks	low
22769	Debian DSA-903-2 : unzip - race condition	Nessus	Debian Local Security Checks	low
21480	FreeBSD : unzip -- permission race vulnerability (9750cf22-216d-11da-bc01-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	low
20605	Ubuntu 4.10 / 5.04 : unzip vulnerability (USN-191-1)	Nessus	Ubuntu Local Security Checks	low
20125	Mandrake Linux Security Advisory : unzip (MDKSA-2005:197)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2005-2475

critical

Tenable Plugins

low

low

low

low

low

low

low

medium